Skip to main content
Contact Us
My preferencesSign out
Proofpoint, Inc.

Searching the Email Archive

  1. Last updated
  2. Save as PDF
Situation

Customer wants to know how to search for emails in the Archive. Here is a guide to help them. 
Solution Follow the instructions below to learn how to search the Proofpoint Essentials Archive. 

 

About searching

Depending on your permissions, you may be able to search the Archive for all messages or just for those for which you were a participant (sender or recipient, directly or as part of a distribution list). You can perform a simple search for a keyword that appears in any element of the archived email (in the subject line, address, body, etc.) or for a keyword in a specific element of the archived email (e.g., just in the subject line).

By default, searching retrieves messages regardless of date, but you can choose to limit the search for messages within a specific timeframe. You can also define more complex searches, for example, searching for archived emails from John Doe that you received this month and that had a subject of "meeting" and a PDF extension.

Performing a search

Simple search

To perform a simple search of the Archive:

  1. In the sidebar, click Search.
    clipboard_e5c6a41dc2b0f99d2fc21ee994450bb3b.png

  2. Enter the word or phrase for which you want to search in the keywords field.
    The screen expands to show your word or phrase in every searchable field. 

  3. To carry out the search across all fields, click Search.

  4. To search for the word or phrase in just one field (e.g. subject), click the field name.

  5.  If necessary, repeat the process to include other search criteria.

  6. To restrict the search to a specific timeframe, click date and choose a time period.
    clipboard_e62393357dd0d11d576ce977bada68bc1.png

  7. Click Search.

Note: To clear all or part of the search criteria, click Clear.

clipboard_e0bf1076898a5e2688cdd72f0b3223ebf.png

When adding more than one item to a search field, enter the additional term and press RETURN. The term will be automatically added to the currently selected search field. Repeat this step when adding multiple terms to a single search field.

Extended search

To access the extended search controls:

  1. In the sidebar, click  Search. All search options are should be visible.

  2. For one or more of the available fields, make a selection and enter the keyword or phrase for which that field is to be searched. For example, you could search for archived messages exchanged this month between Jane Cleaver (jsmith@bobsbooksupplies.com) and Bill Smith (bbrown@seroom.com) that included the word "agenda" in the subject. By default, the field is searched for all of the keywords, but you can choose to specify one of the following for each field:

    ALL OF

    Returns messages that contain all of the terms entered for a field; for example, searching for email content with ALL OF “agenda” and “time” returns messages that contain both those terms, but not those that contain just one of those terms.
    ANY OF

    returns messages that contain any of the terms entered for a field; for example, searching for email content with ANY OF “agenda” and “time” returns messages that contain both those terms, as well as those that contain just one of those terms.
    NONE OF

    returns messages that do not contain any of the terms entered for a field; for example, searching for email content with NONE OF “agenda” and “time” returns only messages that do not contain those terms.

 

  1. Click Search.
You can press TAB to move between search fields on the extended search view.

Searchable fields

Field Description Example

Mailbox

search for all messages sent by and to specified email address

username@domain.com

From

search for all messages sent by specified email address or display name

jsmith@bobstoybarn.com

Jane Smith
To search for all messages sent to specified email address or display name

jsmith@bobstoybarn.com

Jane Smith
Subject search for messages where the subject contains specified content; can include a string of words or individual words

This is the subject

this, is, the, subject
Content search for messages where the header, subject, body or attachment contains specified content; can include string of words or individual words dog, cat, ball
Attachment Content search for messages where the attachment contains specified content; can include string of words or individual words dog, cat, ball
Attachment Name search for messages where the attachment name and/or extension of email attachment contains specified content: can include file name and extension or simply extension

myfile.mp4

mp4

myfile
Date search for messages that were archived on a specified date or date range; can include any, today, yesterday, this week, this month, this year, date range  N/A
Match Type

By default, only messages containing content that exactly matches what is entered in the Keywords box are found. You can choose to also find only potential matches, that is, messages or attachments that match the criteria but are not fully indexed due to size, or to find both types of matches. Click and select the desired matching:

  • For exact matches only 

  • For potential matches only 

  • For both exact and potential matches

 N/A

Search examples

End users

To search for...

You can...

all your archived messages

just click Search

all your archived messages that you sent or received today

select "Today" from the date range (i_daterange.png) and click Search

only messages you sent to Jane Cleaver (jcleaver@bobstoybarn.com) last month that mentioned hope and "project"

in the search field, enter "jcleaver@bobstoybarncom" and click To

in the search field, enter "hope" and click Subject

in the search field, enter "project" and press RETURN

click Search

Discovery users

To search for...

You can...

messages exchanged between and Jane Cleaver (jcleaver@bobsbooks.com) and Bill Smith (bsmith@seroom.com) 

click  i_advancedsearch.png  and enter  jcleaver@bobstoybarn.com in the Mailbox field

enter bsmith@seroom.com in To field

click Search

messages received by any employee last month that contained the word "confidential"

click  i_advancedsearch.png  and, from the Date list, select "Between", then set the date range for the previous month

in the Content field, enter "confidential"

click Search

Working with search results

Archived email messages matching the search criteria are listed on the search screen. showing the subject line, date/time, "from" address and "to" address of each message. Clicking on a message in the search results displays the full message in the right panel of the screen.

You can forward a found message to another internal user (that is, a user with an email address from your company domain): click the forward icon  clipboard_e79bd4d73f353b72da805cde74acbd73a.png  and enter the email address to which the message should be sent.

Messages that exceed 10MB cannot be retrieved.

Sorting Search results

Search results can be sorted in one of the following ways: 

Option Description
Archived Date This value reflects the date/time that the email was captured and stored in the archive. For an email that was imported, this reflects the date of the import processing, not the "received" header value. (Previously Date Received)
Received Date This value reflects the "date" value in the email header. (Previously Date Sent)
Size This value reflects the total size of the email, including attachments.

 

To change the sort order:

  1. Enter your search criteria.

  2. Click Search.

  3. Click the results column title to Sort.
    clipboard_e5122449e43632fd5281fc987138ea688.png

Click any results column title once for newest/ascending or twice for oldest/descending.

 

Saving a search

To save your search parameters for re-use:

  1. Enter your search criteria.

  2. Click Search.

  3. Click the save icon above the search results table.
    clipboard_e5102efb0b29eb102db3dd0734ea8e5c5.png

  4. When prompted, enter a name for the search and click Save.

Because messages are retained in the Archive for a specific period of time, it is possible that search results, even when re-running a saved search, will differ if messages found by the original search have been disposed from the Archive.

Exporting Search Results

Search results can be exported by discovery users only. End users can only view their own messages but not export them. 

Exported data will be in .eml format in a compressed (.zip) file. Only 100K messages can be exported at a time. If your search results exceed 100,000 messages, use additional search parameters (i.e., mailbox, date, etc.) to reduce the search results.

To export your search results:

  1. After performing a search, click the Export icon above the search results table.

    clipboard_eda524908e0f4caf70a918767275db192.png

  2. When prompted, enter a name for the search.

  3. Optionally, enter a password for the file.

  4. Click Export.

Search results are added to an export job (.zip) that your browser will automatically download.