Limit the time window and refine your search criteria
For the best results, limit the time window and refine your search criteria.
- If you knowf the specific time window of the email you are attempting to locate, restrict the search to a shorter time period (days or hours). This provides a quicker search response.
- Using one or more indexed fields in your search criteria will significantly improve search performance.
- Sender IP
- Sender Address
- Recipient Address
- Time stamp
- Add fields in the "Select more search options" where available; add a Service, Sending server, external IP etc. to significantly narrow the search results.
Result format (UI vs CSV files)
When asking for results in the UI versus asking for a CSV file through email, consider the following:
- UI - The UI will return results for up to 2,000 rows.
- If you expect that results will be greater than 2,000 rows, request a CSV file to be emailed.
- CSV - The CSV file will deliver results up to 10,000 rows.
When to expect results
How long should a report take?
- Results should return in the UI within seconds or minutes.
- The search will time out if it is too complex and/or takes over 30 minutes to complete.
- Results that are requested via emailed CSV can arrive within minutes.
- During peak periods, results may take a few hours depending on the query load.
What causes timeouts and failed searches?
- Using any non-indexed fields (indexed fields are listed above) for searches, especially multiple non-indexed fields, will greatly increase the chances of a failed search.
Note: We have recently surveyed the most frequently used non-indexed fields and we are working to add them to our next release. If non-indexed fields are essential in the search then adding one or multiple indexed fields, in addition, will improve the chances of success.
- When searching on a subject field based on a word, use all the characters you have. For example:
Avoid using *@*.* in sender & recipient fields when combining with other search parameters.
- Don't use the letters "Ref" when searching for the word "Referral" as you significantly increase the chances of a failed search by widening the search parameters.
- Additionally, using "subject starts with" or "subject ends with" provides faster results than "subject contains".