Field Search

When performing a field name search, either the Shortcut or the default Search Field text can be entered into the search bar.

You can search any field by typing the field name, followed by a colon “:” and then the term you are looking for.

You can specify field names using the following query syntax guide. Please note that the Search Field text is case-sensitive:

The Alt Workflow Tags field contains the alternate workflow tags created and assigned to documents by the review team.

To search for all documents associated with specified tag(s):

• type meta.workflow:<your tags> for releases <3.0.
• type meta.alt_workflow:<your tags> for releases >3.0.

The Archival Created Date/Time field contains the created datetime for a project that is stored during archiving.

Type meta.archive_created_datetime:<date> to search on the created date/time for projects that have been archived.

The Archival Modified Date/Time field contains the modified datetime for a project that is stored during archiving.

Type meta.archive_modified_datetime:<date> to search on the modified date/time for projects that have been archived.

The Audio Duration field contains the length of any audio or video file in seconds.

Type meta.Audio_video_Length:<value in seconds> to find audio or video recordings of a certain duration.

For example, type meta.Audio_video_Length:>30.0 to find all recordings lasting longer than 30 seconds.

The Batch Set Name field contains the name of the batch set associated with the documents. Type batching.batchset_name:<batch set name> to search for documents associated with a specific batch set.

For example, use batching.batchset_name:"Batch Set 1" to find documents that belong to the batch set named Batch Set 1

The Custodian field contains the custodian name associated with the documents at the time of upload.

Type custodian:<custodian name> to search on the custodian name associated with the documents at the time of upload.

For example, typing custodian:"Jane Doe" will find all documents associated with the custodian Jane Doe.

The Custom Detection field contains labels for each custom detection rule that returns a hit on the document.

Type meta.custom_tags:<custom detection tags> to find all documents with custom tags.

To find all the documents in the review population that were decrypted before processing:

• type meta.Is_password_protected:1 or meta.Is_password_protected:True for releases <3.0.
• type meta.is_password_protected:1 or meta.is_password_protected:True for releases >3.0.

The Document ID field contains Canopy’s unique ID associated with a document.

Type id: followed by the document ID number with no spaces.

For example, type id:2FG2G55FGFto find the document with ID #2FG2G55FGF.

Type id:(2FG2G55FGF OR 2FG2G55CGF OR 3FG2G55FGF) for a list of Document IDs or alternately, id:(2FG2G55FGF 2FG2G55CGF 3FG2G55FGF).

The Document Page Count field contains the number of pages in a document. Type page_count:>1 to find documents with more than one page or page_count:1 for documents with exactly one page.

To find all the emails with attachments:

• type is_Attachment:1 or is_Attachment:True for releases < 3.0.
• type has_attachment:1 or has_attachment:True for releases > 3.0.

The Email BCC field contains all BCC’d display names.

Type meta.eml_Bcc_DisplayName:<email goes here>.

The Email CC field contains all CC’d display names.

Type meta.eml_Cc_DisplayName:<email goes here>.

The Email Classification field contains SPAM (junk email) and HAM (non-junk email) classifications as identified by Canopy during processing.

Type meta.eml_clsf_type to show results of Canopy’s SPAM and HAM detection.

The Email Created Date/Time field contains the email creation date and time as extracted from the email during processing, using IndependentSoft.

Type meta.eml_CreationTime meta.eml_CreationTime:<date>, or meta.eml_created_datetime:<date> for releases including and >3.0, to find emails by creation datetime.

The Email From field contains the full SMTP value for the sender of an email message.

Type from:<from name>

For example, type from:johndoe to find all emails from johndoe@thismail.com and johndoe@thatmail.com.

Typing from:*thismail.com will find all emails from individuals with thismail.com in their email address, or typing from:.gmail.com will find all documents sent from a gmail address. This is equivalent to a domain search.

The Email Modified Date/Time field contains the email last modified date and time as extracted from the email during processing using IndependentSoft.

Type meta.eml_LastModificationTime:<date> to find emails by last modified date and time.

The Email Provider Send Date/Time field contains the date and time the email provider sent the email.

Type meta.eml_ProviderSubmitTime:<date> to find emails by the date and time they were sent by the email provider.

The Email Received Date/Time field contains the date and time the email is delivered to the recipient’s email server.

Type meta.eml_MessageDeliveryTime:<date>, or meta.eml_message_delivery_datetime:<date> for releases including and >3.0, to search on the date and time the email was received by the individual.

For example, typing meta.eml_MessageDeliveryTime:"2001-01-30 00:00:00.000" will locate all documents received on 2001-01-30.

The Email Recipient Number field contains the number of recipients in an email.

Type meta.eml_AllRecipientsNos:<number> to search on the number of recipients in an email.

The Email Report Date/Time field contains the report date and time.

Type meta.eml_ReportTime meta.eml_ReportTime:<date> to find email reports by date and time.

The Email Send Date/Time field contains the date and time an email is sent from an email client.

Type meta.eml_ClientSubmitTime:<date>, or meta.eml_client_submit_datetime:<date> for releases including and >3.0, to search on the date emails were submitted.

For example, typing meta.eml_ClientSubmitTime:"2001-01-30 00:00:00.000" will locate all emails submitted on 2001-01-30.

The Email Domain field contains the domain name of the sender or recipient email address.

Type eml_domains_from:"gmail.com" to search for emails and email attachments from the gmail.com domain. Type eml_domains_to:"gmail.com" to search for emails and email attachments to the gmail.com domain.

The Email To field contains the full SMTP value for the recipients of an email message.

Type To:<toname>.

For example, type To:johndoe to find all emails to johndoe@thismail.com and johndoe@thatmail.com.

Typing To:*thismail.com will find all emails to individuals with thismail.com in their email address, or typing To:.gmail.com will find all emails sent using a gmail address. This is equivalent to a Domain Search.

To search on a list of documents based on their relationship to other documents the following boolean fields can be used:

has_Attachment has_Parent

For example,

• type has_Attachment:1 to find all documents that contain attachments.
• type has_Parent:1 to find all documents that have parents.

The File Created Date/Time field contains the date and time when a document was initially created as maintained by the application, if the application supports this type of metadata.

Type meta.metadata_created_datetime:<date> to find documents by their created datetime.

The File Extension field contains the text extension of the file name.

Type filetype: followed by the type of document with a period and no spaces.

For example, typing filetype:.doc will search all MS Word Documents, filetype:.pdf will search all PDF documents, and filetype:.txt will search all text documents.

Similarly, you can enter .eml, .msg, etc.

The File Modified Date/Time field contains the date and time when the content or properties of a document were last changed as maintained by the application, if the application supports this type of metadata.

Type meta.metadata_modified_datetime:<date> to find documents by their modified datetime.

The File Size field contains the size of files in bytes.

Type size: followed by the size of files.

For example, typing size:>1000 will find all files greater than 1000 bytes, or typing size:146 will find file size in binary.

The Folder Path field contains the full path to the file located in Canopy’s infrastructure.

Type meta.full_name:<searchwithwildcard?*>.

The Image Classification field contains the following list of image classifications.

Type img_clsf_filter:<image class search name>).

Refer to the list of images classes here.

Type meta.dimension.width:>1000 to search for images with a width larger than 1000 pixel. And type meta.dimension.height:>1000 AND meta.dimension.width:>1000 to search for images with width and height larger than 1000 pixels.

The Language field contains the predominant language contained in documents.

Type Language:<language name> to search on the primary language detected in documents.

For example, typing Language:Catalan will find all documents using Catalan as the primary language.

The Language Confidence field contains the primary language detection confidence level.

Type Language_confidence_level:<number between 1-100> to check the primary language detection confidence level.

For example, typing Language_confidence_level:>80 will show documents with a greater that 80 percent chance of being written in the primary language being searched.

The MD5 Hash field is the MD5 hash value of the file.

Type md5:<hash value goes here>.

This Master Created Date/Time derived all the other date fields collected from the document. The Master Date is populated by the first date present in this prioritized list:

meta.archive
This date is present if the archive stored it at the time of archival. It is not the date the file was archived but the created and or last modified date copied from the system at the time of archival.

Type meta.master_created_datetime:<date>

The Master Created Date/Time Source Field column contains the date field name used to populate the Master Created Date/Time.

Type master_created_datetime_source_field:<string>

The Master Created Date/Time Source Search ID column contains the document Source ID associated with the Master Created Date/Time Source Field.

Type master_created_datetime_source_document_id:<id>

This Master Modified Date/Time derived all the other date fields collected from the document. The Master Modified Date is populated by the first date present in this prioritized list:

meta.archive
This date is present if the archive stored it at the time of archival. It is not the date the file was archived but the created and or last modified date copied from the system at the time of archival.

Type master_modified_datetime_source_field:<date>

The Master Modified Date/Time Source Field column contains the date field name used to populate the Master Modified Date/Time.

Type meta.master_modified_datetime:<date>

The Master Modified Date/Time Source Search ID column contains the document Source ID associated with the Master Modified Date/Time Source Field.

Type master_modified_datetime_source_document_id:<id>

The Name field is populated with either the file name or, in the case of emails, the email subject.

Type filename:<file name or email subject>

For example, type filename:Acadia*

Using the asterisk * will search all documents with filenames starting with “Acadia.”

The OCR-Performed field contains a boolean value indicating whether OCR was performed on the document.

Type meta.ocr_performed:true to find documents that have been through OCR and meta.ocr_performed:false to find those that haven’t.

Boolean values are case-sensitive; thus, “true” and “false” must be lowercase.

Every PII element has a corresponding count found on each document saved in the database. The formula to access this field is:
meta.pii_density.[element search name].

For instance, you can search on the count aba you would use meta.pii_density.aba. If the search name includes spaces, for example austria passport you would surround the field with double quotes like this: "meta.pii_density.austria passport".

By using this count field (aka density), then you will be able to use the range search function as described previously. Here are some examples of range searches for PII counts.

All documents with element counts of 100 to 1000:

meta.pii_density.aba:[100 TO 1000]
"meta.pii_density.austria passport":[100 TO 1000]

All document with element counts 100 or greater:

meta.pii_density.aba:[100 TO *]
"meta.pii_density.austria passport":[100 TO *]

Use curly brackets to specify exclusive ranges {min-max}:
Documents with element counts between delta and sigma, excluding delta and sigma:

meta.pii_density.aba:{delta TO sigma}
"meta.pii_density.austria passport":{delta TO sigma}

Documents with element counts less than 1000:

meta.pii_density.aba:{* TO 1000}
"meta.pii_density.austria passport":{* TO 1000}

Curly and square brackets can also be combined:
Document with element counts from 1 up to but not including 1000.

meta.pii_density.aba:[1 TO 1000}
"meta.pii_density.austria passport":[1 TO 1000}

The following syntax can be used for ranges with one side unbounded:

meta.pii_density.aba:>100
"meta.pii_density.austria passport":>100

meta.pii_density.aba:>=100
"meta.pii_density.austria passport":>=100

meta.pii_density.aba:<100
"meta.pii_density.austria passport":<100

meta.pii_density.aba:<=100
"meta.pii_density.austria passport":<=100

meta.pii_density.aba:>100
"meta.pii_density.austria passport":>100

meta.pii_density.aba:>10
"meta.pii_density.austria passport":>10

To combine an upper and lower unbounded range, join the two clauses by using the AND operator:

meta.pii_density.aba:(>=100 AND <1000)
"meta.pii_density.austria passport":(>=100 AND <1000)

meta.pii_density.aba:(+>=100 +<1000)
"meta.pii_density.austria passport":(+>=100 +<1000)

The PII Elements field contains a list of PII element types detected in the file.

Type piitag:<PII Element Search Name>.

You can also search on multiple PII Elements. For example, type piitag:(acc OR address OR age) or piitag:(acc address age). Using a space between elements will also function as an OR operator.

The QA Created Date/Time field contains a QA batch’s date and time.

Type meta.batching.create_datetime:<date> to search for documents in the QA batch that were created on the date/time specified.

The QA Reviewer field contains the name of the user who performed the QA Review.

Type qareviewer:<"firstname lastname"> to search all documents QA reviewed by a certain individual.

For example, typing qareviewer:"Jane Doe" will search all documents QA reviewed by Jane Doe.

The Reviewer field contains the name of the user who performed the Standard Review.

Type Reviewer:<"firstname lastname">

For example, typing Reviewer:"John Smith" will find all documents reviewed by John Smith.

The SHA1 Hash field is the SHA1 Hash value of the file.

Type sha1:<hash value goes here>.

The SHA256 Hash field is the SHA256 Hash value of the file.

Type sha256:<hash value goes here>.

The Source field is the name of the uploaded container.

Type meta.sourcepath:<your file with wildcards?*>.

Type suggestedType:<value> to search on one of these two values: "entitypropagate" or "activelookahead".

The Tags field contains the list of user-created tags applied to the file.

When searching for documents with specific tags, type the manual tag name followed by the tag value.

For example, type tag:qa to search all QA tagged documents.

When searching for documents not tagged a certain way, type - followed by the tag name and tag value:
-piitag:socialsecuritynumber

Typing NOT followed by the tag name and tag value will yield the same result:
NOT piitag:socialsecuritynumber

The Text Length field contains the length of documents in text characters.

Type content.length:<number> to search on the length of text in characters.

For example, typing content.length:130 will find all documents with a text length of 130 characters.

This field is currently called Total PII Density and will be renamed in an upcoming release.

The Total PII Count field contains the count of all PII detected in a document.

Type meta.total_pii:<number>

For example, typing meta.total_pii:3 will show all documents with 3 PII tags.

The Uploaded Date/Time field contains the date and time when the file was uploaded in the system.

Type meta.uploaded_datetime:<date> to find all files uploaded on a specific date.

For example, typing meta.uploaded_datetime:"2020-01-30 00:00:00.000" will find all files uploaded in the system on 2020-01-30.