Archive Manager for Exchange 8.9 - ArchiveWeb Guide

How to build search queries

This topic describes how to build search conditions using the keyword search and advanced search capabilities of Archive Manager for Exchange. A search condition (or query) can contain zero or more search clauses that are combined using operators and grouping of search clauses.

In this topic

·Simple conditions

·AND/OR operators

·Grouping

·Keyword search

Simple Conditions

A simple search conditions needs no search clause or can contain just one search clause.

Example 1

Click Search without adding a search clause. In this case, you will get back all the archived items.

Query

Result

Example 2

Add a single search clause with a condition where the field Subject contains the word "them". When you click Search, you will get back all the archived items where the Subject contains the word "them".

Query

Result

AND/OR operators

The AND/OR operator is used between two search clauses. With these operators, you can combine two or more search clauses. The AND operator will return a search result if both the search clauses separated by the AND operator are fulfilled. The OR operator will return a search result if any one of the search clauses separated by the OR operator are fulfilled. The AND operator has a higher priority over the OR operator. When a search condition contains both the AND and OR operators, the search clauses that are combined with the AND operator must be fulfilled first.

Example 1

To find all items where the Subject contains word "them" AND the Sender is "amadmin", you must combine two search clauses as shown:

Query

Result

Example 2

To find all items where the Subject contains word "them" OR the Sender is "amadmin", you must combine two search clauses as shown:

Query

Result

Grouping

Sometimes simple combinations of search clauses with the AND and OR operators are not enough. Grouping is a good solution to change the priority between the operators. The grouped search clauses have a higher priority than the operator before or after the group. The examples in this section describe how the grouping works.

Example 1

To find all items where the Subject contains the word "them" AND the Sender is "amadmin", and all these items must also have an attachment then the search condition is as shown:

Query: (Subject contains "them" OR Sender is "amadmin") AND has attachment

Result: (Subject contains "them" OR Sender is "amadmin") AND has attachment

We can split this search condition into two parts

1. (Subject contains "them" OR Sender is "amadmin") which is a group

2. AND has attachment

Since a grouping has a higher priority, the search condition in the group must be fulfilled first. In this case each item in the search result will have a Subject that contains the word "them" AND the Sender is "amadmin", and the item will also have an attachment

Example 2

To find all items where the Subject contains word "them" or, the Sender is "amadmin" and at the item must have an attachment, then the query is as shown:

Query: Subject contains "them" OR Sender is "amadmin" AND has attachment

Result: Subject contains "them" OR Sender is "amadmin" AND has attachment

This query we can be split into two parts

1. Subject contains "them" OR

2. Sender is "amadmin" AND the item has an attachment

The AND operator has a higher priority so the search clauses combined with the AND operator must be fulfilled first. In this case the search result will contain items where the item must have an attachment and the Sender must be "amadmin", or Subject should contain the word "them".

Example 3

To find all items where the Subject contains the word "them" and the Sender is "amadmin", or the item has attachment, and the item must be in the "Inbox" folder then the search condition is as shown:

Query: Subject contains "them" AND (Sender is "amadmin" OR has attachment) AND Folder path: Inbox

Result: Subject contains "them" AND (Sender is "amadmin" OR has attachment) AND Folder path is "Inbox"

This query can be split into three parts

1. Subject contains "them" AND

2. (Sender is "amadmin" OR the item has an attachment)

3. AND Folder path is "Inbox"

The grouped search clauses have the higher priority in this query so the search condition in the group must be fulfilled first. In this case the search result will contain items where the Subject must contain the word "them" + Sender should be "amadmin" or the item has an attachment + the folder path must be "Inbox".

Example 4

To find all items where the Subject contains the word "them" and Sender is "amadmin", or the item has an attachment and these items should be in the "Inbox" folder then the search query is as shown:

Query: Subject contains "them" AND Sender is "amadmin" OR has attachment AND Folder path: Inbox

Result: Subject contains "them" AND Sender is "amadmin" OR has attachment AND Folder path is "Inbox"

This query can be split into two parts

1. Subject contains "them" AND Sender is "amadmin" OR

2. Item has attachment AND Folder path is "Inbox"

The AND operator has a higher priority in this query so the conditions with the AND operators must be fulfilled first. In this case the search result will contain all items where Subject contains the word "them" and Sender is "amadmin" or the item must have an attachment and the folder path must be "Inbox".

Example 5

To find all items where the Subject contains word "them" or these items are in the "Inbox" folder, and the Sender is "amadmin" or the item has an attachment, then the query is as shown:

Query: (Subject contains "them" OR Folder path: Inbox) AND (Sender is "amadmin" OR has attachment)

Result: (Subject contains "them" OR Folder path is "Inbox") AND (Sender is "amadmin" OR has attachment)

This query can be split into two parts:

1. (Subject contains "them" OR Folder path is "Inbox") AND

2. (Sender is "amadmin" OR item has attachment)

The grouped condition has the higher priority in this query so the conditions in the group must be fulfilled first. In this case the search result will contain items where Subject should contain "them" word or folder path should be "Inbox" + Sender should be "amadmin" or the item should have an attachment.

Example 6

To find all items where the Subject contains the word "them" or, these items are in the "Inbox" folder and the Sender is "amadmin", or the item has an attachment, then query is as shown:

Query: Subject contains "them" OR Folder path Inbox AND Sender is "amadmin" OR has attachment

Result: Subject contains "them" OR Folder path Inbox AND Sender is "amadmin" OR item has an attachment

This query can be split into three parts:

1. Subject contains "them" OR

2. Folder path is "Inbox" AND Sender is "amadmin"

3. OR item has an attachment

The AND operator has a higher priority so the conditions with the AND operator must be fulfilled first. In this case the search result will contain items where Subject must contain the word "them" or folder path must be "Inbox" and Sender must be "amadmin" or the item has an attachment.

Keyword search

Keyword search provides a fast and flexible search for keywords in the email Subject, body, and attachments of messages in Archive Manager for Exchange. If you leave this field empty, then the search result will show all archived messages. If you enter a word or phrase in the keyword field and click Search the result of the search will show all the archived messages where the Subject, body or attachment contains the entered word or phrase.

Example

You can combine keyword searches with advanced search clauses to find specific messages. Keyword searches are combined with advanced search conditions with the AND operator. The search result will contain items that have the keyword and the advanced search conditions as well. To find all messages where the Subject, body or attachment contains word "mother" and the Subject also contains the word "them", the search query is as shown:

Query

Result: The body of the message contains word "mother", and the Subject contains word "them"

Search History

Every search in ArchiveWeb is logged and displayed in the History page. Search history is stored in the search history cache separately for each logged in user who runs a search. Each search history log entry indicates the search type (Exchange, File or Keyword) and the start date and time of the search in the log entry header.

In this topic:

·Viewing the search result summary

·Viewing the search query

·Viewing the search results

·Editing the search query

·Saving the search query

·Extending search history

·Cleaning up search history

Viewing the search result summary

1.Click Search on the main menu and then click History.

2.Click to show the Search result summary section.

The search result summary section presents the following information

a.Started by - username of the person who ran the search.

b.Start time - date and time the search was started.

c.SID - unique search identifier.

d.End time - date and time the search was completed.

3.Click to hide the Search result summary section.

Viewing the search query

1.Click Search on the main menu and then click History.

2.Click to show the Search query section.

The search query section presents the following information

a.Scope equals - the application data that is searched.

b.Include equals - the data set within the search scope that is included in the search.

c.Mailbox equals - the mailboxes that are included in the search.

d.SQL Query equals - SQL query that was used to search for archived items.

e.Maximum number of search results equals - the upper limit of the result set that was configured for ArchiveWeb when the search was started.

3.Click to hide the Search query section.

Viewing the search results

1.Click Search on the main menu and then click History.

2.Locate the search you want to review.

3.Click to rerun the search. The search results page will open with the search results.

Editing the search query

1.Click Search on the main menu and then click History.

2.Locate the search you want to review.

3.Click to edit the search query. The main search page opens where you can review and revise the search options and query.

Saving the search query

1.Click Search on the main menu and then click History.

2.Locate the search you want to review.

3.Click to save the search query. The Save Search As dialog opens.

4.Enter a suitable name in the Search template name field. Then click Save to save the search query as a template.

Extending search history

The search history page displays the last 10 searches by default. To customize the display limit follow the steps described below:

1. Open the C:\Program Files\Quest\MAMSearch\PamSearch.exe.config file.

2.Add a new section name (if it does not exist) under the <configSections> node

3.Create a new SearchHistory section (if it does not exist)

4.The maxcount value can be any number between 1 and 2147483647. When this key is missing from the PamSearch.exe.config file, the default value 10 is used.

Cleaning up search history

Search history is stored SQLITE files in a cache folder. The default location is C:\Program Files (x86)\Quest\MAMSearch\SearchCache\<userSID>\*.sqlite and the cache is periodically cleaned. To customize the search history cache retention time limit follow the steps described below:

1. Open the C:\Program Files\Quest\MAMSearch\PamSearch.exe.config file.

2.Add a new section name (if it does not exist) under the <configSections> node

3.Create a new SearchHistory section (if it does not exist)

4.The timelimit format is days.hours:minutes:seconds. For example, the value 365.23:59:59 indicates that the search history entries will be stored for 365 days, 23 hours, 59 minutes and 59 seconds.

Search Templates

When you expand the Search > Templates node, you may see a list of search templates that have been saved so far (search results can be saved from History tab as described in the “History” section).

Click on the arrow next to the template to expand the template node. Under this node you will see the link to respective search results - with the date and time when they were saved.

Clicking the search results link will display the search results in the main pane. Here you can benefit from the filtering functionality as in all ArchiveWeb lists – grouping, filtering by status (tagged, locked etc.) and creating custom filters.

The MENU link in the top right corner of the item detail pane offers additional actions for the selected item:

·Download to MSG file or Download to EML file – download the selected item.

·Restore or Restore to – restore the selected archived item to original item.

·Export to ZIP - exports the item to a ZIP file.

·Add tags or Remove tags – adds or removes a tag from the selected item.

·Lock/Unlock document – locks or unlocks selected item.

·Mark for deletion – marks the selected item for deletion. The item will be deleted according to the retention category in use.

·Extend retention time – increase the time for which the item cannot be deleted from the archive. Setting shorter retention than the  actual  retention  is  not supported. After the specified period (in months) the item can be deleted manually or by a Delete job if such is scheduled in respective Enterprise Manager.

·Create retention change request – send a request to the approving person for selected item deletion or increased retention time when it can't be deleted from the archive. The Approver who is the person with adequate permission in Archive Manager, will receive the request through email notification if Archive Manager SMTP is properly configured.

Templates handling

When you click on any template name under the Templates node, ArchiveWeb redirects you to the given search criteria page. It can be either Exchange, Files or Common search depending on the template. All search criteria are configured by the template. You can click Search to perform the same search with the search settings specified in this template.

On the screenshot below you can see how the template is displayed once you click its name under the Templates node. The main pane presents the usual Exchange/Files/Common search window. The only difference is the bottom part of the windows. There you see the template metadata (name, user, date of creation etc.) and action buttons:

·Search – runs search query

·Delete – deletes the template completely from the Templates node

Report

With Report functionality at hand, users have overview of their email and/or file archives. Clear concise information in terms of how many items were archived, when, what is their size – original or shortcut etc. Files features also information on retrieved items.

Report section consists of two tabs - Statistics tab with information on archived emails/items and Audit tab with logs of user actions.

Please note that full access to this functionality must be granted to the user under Permissions (see the Roles & Permissions section).