Knowledgebase
Search - Custom
Posted by Rob Chidester on 02 July 2014 06:56 PM

Sonian

Custom Search

OVERVIEW

The custom search feature is intended to provide advanced users with the flexibility to create searches that are more complex than those that are available via the Simple, Advanced, or Wizard-based search features.  Examples of capabilities that are accessible via Custom Search include:

Advanced Boolean Queries - Combining Boolean logic (i.e. AND, OR, NOT) with grouping to locate messages or documents based on a combination of nested conditions.

Fuzzy Queries - Including common misspellings and alternate spellings of search terms in results.

Proximity Queries - Searching for terms that exist within a certain number of terms of one another in a document or attachment.

Advanced Date/Time Queries - Combining date/time ranges with Boolean logic and/or wildcard capabilities to search for messages based on a variety of time-related criteria.

NOTE: Custom search might yield different search results apposed to the other search types. When inputting items into a custom search query, our search mechanism will search on exactly what is inputted creating a more precision search. When using Simple, Advanced, or Wizard search our search mechanism will fit in other backed fields that may give your more items than a Custom search to help give you a wider range of data to review.


CREATING A CUSTOM SEARCH

The process of creating a custom search is as follows:

        1. Access the Custom Search feature:

                * Log in as a Search Administrator.

                * Click the “Start New Search” button from the Dashboard or Search tab. 

                * Once the “New Search” page loads, click the “Custom” tab.

        2. Enter a name for the new custom search. 

        3. Create a Custom Query.  For assistance creating a custom query, read below.

        4. (Optional) Select the start date for the search using the “Begins On” date picker.        

        5. (Optional) Enter the end date for the search using the “Ends On” date picker. If you leave the "Ends on" field blank, the results will start from the date chosen in the "Begins on" field and go to the most recent collected messages (most of the time, today's date). 

        6. (Optional) Enter Tags and/or Notes for the Search.

        7. (Optional) Select whether you want to display 1) All results 2) only results on legal hold 3) exclude results on legal hold. Note that this optional field can be used as the sole search criteria/condition.

        8. (Optional) Select Permissions to display the drop-down menu allowing to give search user access to this specific search. This option allows you to allow an archive user to either 1) access this search 2) edit this search 3) export this search or any combination thereof.

        9. Click “Save and Display Results” to save the search and go directly to the search results or "Save and return to list" to save the search and go back to the SAVED SEARCHES pages displaying all the previously created searches.

*Note that constructing Custom Queries is typically an iterative process--particularly against large data sets.  After reviewing the results of the initial query, users can refine the search by clicking “Edit Search to Generate New Results”.

Screenshot - Custom search


CUSTOM QUERY SYNTAX

Custom query terms are the “what and where” components of the search--they enable you to specify what information to search for, and in which index fields to look for that information.

NOTE: If the terms or phrase you are searching for contains a ":" you need to include the search terms or phrase between quotation marks ("..."). For instance, if you are looking for the terms/phrase the broker did the following: then, you would have to write in the search terms field: "the broker did the following:"


Custom Query Fields

To specify a field to query, you would type the name of the field, followed by a colon (with no space in between).  The available fields are as follows:

            subject: - Refers to the contents of the “Subject” field within the headers of messages.

            body: - Refers to the contents of the “Body” field in the headers of messages.  ***Note that the body field is also the default field, specifying the “body:” field for a term is optional.

            date: - Refers to information in the “Date” field in the headers of messages.

            from: - Refers to addresses that are contained in the from: field in the headers of messages.

            recipients: - Refers to addresses that are in the To:, Cc:, or Bcc: fields in the headers of messages.

            bcc: - Refers to addresses that are specifically in the Bcc: field within headers of messages.

            attachments.content:- Refers to the contents/body of files that are attached to messages.

            attachments.filename:- Refers to the names of files that are attached to messages.
   
            size:- Refers to the total size of messages (including attachments).  Note that the size field is calculated in bytes.

To search for information within a given field, you would include that information directly after the name of the field (with no space in between).  For example:

            subject:Earnings - Queries the Subject field to locate all messages with the word “Earnings” in the Subject.

            date:[2011-01-01T00:00:00Z TO 2011-12-31T00:00:00Z] (time is GMT format)- Queries the Date field to locate messages that were sent between January 1st and December 31st, 2011.
 
You can also search for phrases within a particular field.  For example:

            subject:”Earnings Results” - Queries the Subject field to locate messages with the phrase “Earnings Results” in the subject.
   
            body:”Please do not share” - Queries the Body field to locate messages with the phrase “Please do not share” in the body.

   
     Wildcard Query Operators

You can use wildcard operators to locate messages and/or documents based on partial terms.  You can use the asterisk ( * ) operator to locate messages and/or documents that contain specified partial terms.  For example:
   
             contract* - Denotes any term that begins with “contract” (such as “contract”, “contracts”, or “contracted”).
   
            acme.* - Denotes any term that starts with “acme.com” (such as “acme.com or acme.co.uk).
   
            43931* - Denotes any term that starts with the sequence “43931” (such as “43931.00” or 43931226).
   
You can use the question mark (?) operator to locate messages that contain a specified term, with a given character replaced.  For example:
   
            “???? ???? ???? ????”- Denotes any term that contains four sets consisting of four characters each with a single space between sets (4417 1234 5678 9012, a common format for credit/debit card numbers”).

            “???\-??\-????” - Denotes any term that contains a set of three characters, followed by a dash, followed by two characters, followed by a dash, followed by three characters (i.e. 123-45-6789, a common format for U.S. social security numbers). See the section below, “Searching for Terms that Contain Reserved Characters”, for the explanation of “\” use.

            ?inks - Denotes any term that contains any character proceeded by the string “inks” (such as “links” and “rinks”).
   
            “well gra?e?” - Denotes any phrase beginning with the term “well” followed by a space and then a term that contains the string “gra”, followed by any character, followed by the letter ‘e’, followed by any character (such as “well graded” and “well grates”).


NOTE ON WILDCARDS (*)
: Wildcards can be used with any kind of words or number as long as they contain at least 5 characters or numbers. Using wildcards on words will less than 5 characters or strings with less than 5 numbers won't be effective.

NOTE ON LEADING WILDCARDS (*): Please be advised that you can only use leading wildcard query operators when using the following fields: from, recipients, subject, attachment.filename, bcc. Leading wildcards cannot be used when using the body and attachment.content fields.


Searching for Terms that Contain Reserved Characters

The following fields are reserved for use in the syntax of queries and, as such, require special handling when they are contained within query terms:

            + - & | ! ( ) { } [ ] ^ " ~ * ? : \

In order to search for terms that contain any of these characters, you are required to “escape” each reserved character by inserting a backslash (\) before it.  For example:
   
            body:”1\(555\) 555\-1212” - Queries for any messages with a body that contains the phrase “1 (555) 555-1212”.
   
            subject:promotion\? Queries for any messages with a subject that contains the term “promotion?”.


Boolean Query Operators

You can use Boolean operators such as AND, OR, NOT, +, and - to search for messages or documents based on multiple terms. 

Use the AND operator to locate messages or documents that satisfy two or more criteria.  For example:
   
            body:demotion AND from:acme.co* - Queries for any messages with a body that contains the term “demotion” and a sender that contains a term that starts with “acme.co”.
   
            from:*@betacorp* AND recipients:*jdoe@acmecorp* AND date:[2011-01-01T00:00:00ZTO2011-12-31T00:00: 00Z] - Queries for any messages with a sender address that includes the string “@betacorp” where jdoe@acmecorp is a recipient (To:, cc:, bcc:) that was sent between January 1st and December 31st, 2011.

To locate messages where specific fields satisfy two or more criteria, you use the ‘+’ operator rather than using a more elaborate ‘AND’ query.  For example:
   
            body:(+confidential +IPO +bank) - Queries for any message that contains the terms “confidential”, “IPO”, and “bank” in the body. Parentheses are always needed when using this format with “+” signs; they indicate that the terms are grouped together. An alternative approach would be to write the query body:confidential AND body:IPO AND body:bank.
   
            attachments.content:(+agreement +CEO) AND attachments.filename:*doc* - Queries for any message that includes an attachment with the terms “agreement” and “CEO” in the contents and “doc” in the file name.

Use the OR operator to locate messages or documents that satisfy any of two or more criteria.  For example:
   
            attachments.content:contract* OR attachments.filename:*contract* - Queries for any message that includes an attachment with the terms starting with “contract” in the contents or an attachment with a file name that contains the string “contract”.   

            guarantee* OR subject:guarantee* - Queries for messages that contain a term that begins with “guarantee” in the message body (default field) or subject.


Fuzzy Logic Operators

You can use fuzzy logic operators to query for terms that are close to, but not precisely the same as, a particular term by inserting a tilde (~) after the term.  Fuzzy logic often comes in handy when you want to include misspellings of key terms in the search results.  For example:
   
            body:lawyer~ - Queries for messages that contain terms that are close to the term “lawyer”, such as “laywer” and “lawyers”.

            subject:VIN4422331~ - Queries for messages that contain terms that are close to the term “VIN4422331”, such as “BIN4422331” and “VIN2222331”.

You are also able to adjust the tolerance of the fuzzy logic (e.g. specify how “close to” the search term message terms should be in order to be included in search results.  The tolerance is measured on a 0 to 1 scale, with 1 indicating an exact match to the search term.  The default tolerance is 0.5.  You can adjust the tolerance by inserting the tolerance indicator after the tilde.  For example:

            body:lawyer~0.9 - Queries for messages that contain terms that are very close to the term “lawyer”, such as “lawyers”, but not “player”. 

            lawyer~0.2 - Queries for messages with a body that contains terms that are even remotely similar to the term “lawyer”, including "lawyers”, “player”, “players”, “lawed”.

Note that most customers will need to try a few different tolerance levels before locating the level that works best for a given search.


Proximity Logic Operators

You can use proximity logic operators to query for two terms that occur within a specified number of words of one another within a field.  In order to query using proximity logic, surround the search terms in quotations, separated by a space, followed by a tilde (~) and one or more digits to indicate the number of words.  For example:

            ”manager HR”~10 - Queries for messages with a body that contains the term “manager” followed by the term “HR” separated by up to 10 additional terms.
   
            subject:”pay raise*”~4 - Queries for messages that contain the term “pay” followed by a term beginning with “raise” separated by up to 4 additional terms in the subject field.

Note that the proximity search terms are order-dependent (e.g. “pay raise*”~4 would locate “pay needs to be raised” but not “raise my pay”).

 



Attachments 
 
 search - custom.docx (67.70 KB)

ERROR: This domain name does not match domain registered in the license key file (cms.orlinpilot.com), allowed domains: support.excelmicro.com, please change the product path to match the domain under Admin CP > Settings > General Settings
This product will not work properly unless untill that value is changed.

For more information please contact Kayako support at https://my.kayako.com