Advanced Search Queries for Common Scenarios

Basic search scenarios in this article: 

• Run a proximity search and wildcard search across all private and public messages
• Search for all conversations between custodians with a specified date range while including attachments
• Search for all private conversations (DM/MPIM) where the custodian is active
• Search for all private and channel conversations made by a single custodian (active/inactive) while capturing attachments

Run a proximity search and wildcard search across all private and public messages

• Metadata Fields
  • Extracted Text
  • Conversation Type
  • Parent Workspace Name
• Configuration
  • Set Extracted Text to contains the terms you are looking for separated by a comma.
    • Proximity search
      • Find words within a certain distance of each other
        • Extracted Text _ Contains = term1 ~[distance] term2
          • Example: send ~5 password
      • Wildcard search
        • Regular Expression instead of contains as the operator
        • Place a period and asterisk (.*) at the beginning, middle or end of a word to look for all results including the specified term plus any letters for any number of times in place of the wildcard.
  • Set Conversation type to Is Set to include all conversation types found in Slack. 
  • Set Parent Workspace Name to contains the workspace(s) you'd like to search across or leave blank if you're searching across your entire instance.

Return to top of page

Run a search for all conversations between custodians with a specified date range while including attachments

• Metadata Fields
  • Related Usernames (Only conversations where the user was active will be returned)
  • Conversation Type
  • Parent Workspace Name
  • File Creation Date
• Configuration
  • Set  Related User Names to contains the user(s) you wish to include. For multiple users, you must set each one as a separate line as pictured above.
  • Set Conversation type to Is Set to include all conversation types found in Slack. 
  • Set Parent Workspace Name  to contains  the workspace(s) you'd like to search across or leave blank if you're searching across your entire instance.
  • Set the File Creation Date to before or after a specified date. If you would like to search between two dates, then you would need to have two file creation date criteria with each.

Return to top of page

Run a search for all private conversations (DM/MPIM*) where the custodian is active

*Multi-person instant messages

• Metadata Fields
  • Related Usernames (Only conversations where the user was active will be returned)
  • Conversation Type
  • Parent Workspace Name
• Configuration
  • Set  Related User Names to contains the user you wish to include.
  • Set Conversation type to contains to only private conversations you would like to include. For Slack, this would be DMS and MPIM.
    • Other options for Slack conversation types include groups and channels.
  • Set Parent Workspace Name to contains the workspace(s) you'd like to search across or leave blank if you're searching across your entire instance.

Return to top of page

Run search for all private and channel conversations made by a single custodian (active/inactive) while capturing attachments

• Metadata Fields
  • Related Usernames (Only conversations where the user was active will be returned)
  • Conversation Type
  • Parent Workspace Name
• Configuration
  • Set  Related User Names to contains the user you wish to include.
  • Set Conversation type  to Is Set to include all conversation types found in Slack. 
  • Set Parent Workspace Name to contains  the workspace(s) you'd like to search across or leave blank if you're searching across your entire instance.

Return to top of page