Slack Metadata Searching
Search results can also be refined using metadata fields. A metadata search uses the metadata term, followed by a colon (:) and the search criterion. A list of available metadata terms follows.
* Note: metadata terms marked with * have an alternative form available, which must be used if you wish to match your searches in both View Discovery and in Visual Analyzer. These equivalent metadata terms are described in this section: Long-form Metadata Terms for Use with Visual Analyser
Metadata | Syntax | Sample | Notes |
---|---|---|---|
* User name | user_name:”name” | user_name:”john doe” | The search may not return the expected results if the profile is incomplete or there are ambiguous/partial matches Recommendation: use email address or user id instead |
user_email:”email” | user_email:”john.doe@client. com” | For best results, search using the full email address enclosed in quotes | |
* User ID | user_id:”slack id” | user_id:WJF981Z7U | The id can be found on the Custodians tab under Manage Matter To search for @ mentions of users, see this section. |
* Channel Name | channel:”name” | channel:general | “” are optional |
* Channel ID | channelid:”slack id” | channelid:C2GH37T9U | The channel ID may be found on the Channels tab under Manage Matter |
* Team name | team:”name” | team:myco | Team is synonymous with Workspace name |
Occurred date | occurred:>DD-MMM-YYYY HH:MM:SS occurred:<DD-MMM-YYYY HH:MM:SS | occurred:>01-Sep-2020 12:00:00 | Can also use “Refine by Date Range” operators ***We have a known bug impacting system datestamps. Best practice is to use the data refine boxes under the search query box in the UI. However a workaround for the bug is detailed in the following steps: Step 1: Go to a site which converts dates/time to unix timestamps. One Example: Epoch Converter Step 2: Enter the date/time details (note: 24hr clock!) into the form and choose local time zone (e.g. EDT) - click "Human Date to Timestamp" Step 3: Copy the numeric value and paste it into your search query example: occurred:>1661990400 |
* Edited or Deleted messages | msg_edited msg_deleted | msg_edited msg_deleted |
|
Text | text:text | text:acme | Limits the search for “acme” to only the content of messages (rather than across both message and metadata fields) To search for @ mentions of users, see this section. |
* File type | filetype:”type” | filetype:pdf | Using file extension Use filetype:* to find all attachments |
* File name | filename:”name” | filename:summer.png | Using file name |
Bookmarks | bookmarked:true bookmarked:false |
| Will limit search results to only those messages that have a current bookmark applied or those with no bookmark applied |
Advanced Search Examples |
| ‘(trail* OR 'walking path’) (campground OR campgrounds)'~10
(bikeride or cycle*) AND | Search for terms that are a specified number of words from each other |
Has any Reaction | document.reactions.name:”*” | document.reactions.name:”*” | Search for messages that have any reactions. You can also make more detailed Reactions searches. See this section for details. |
Slack Search Tips
A common approach for searching within a particular channel is using the channel name (e.g., channel:acme). If multiple channels share similar names, you can refine your search using channel ID (e.g., channel_id:D2V3NAJBU). You can find a specific channel ID as listed on the channel tab under Manage Matter.
When searching for messages posted by a particular user, a common approach is to search using a user’s name (e.g., “user_name:”brad harris”). If the name is not unique, or is different in Slack than what is normally expected, consider using an email address instead (e.g., user_email:brad.harris*). If searching for messages posted by a custodian in the matter, you can also use User ID (found on the Custodian tab under Manage Matter).
Searching for Reactions “Reacjis” to Messages
Collection of Reactions is an optional feature for Illuminate.
Metadata | Syntax | Sample | Notes |
---|---|---|---|
Has any Reaction? | document.reactions.name:”*” | document.reactions.name:”*” | Search for messages that have any reactions. |
Specific Reaction | document.reactions.name:”reaction” | document.reactions.name:”pray” | Match whole reaction name |
Wildcard Reaction | document.reactions.name:”*reaction*” | document.reactions.name:"face*" | Match a reaction that starts with “face” |
Reaction skin-tones | document.reactions.name:”reaction” | document.reactions.name:"*skin-tone*" document.reactions.name:"wave::skin-tone-2" | Match a reaction that refers to any skin-tone Match a specific reaction that refers to a specific skin-tone |
Specific user Reacted | document.reactions.users:”slack id” document.reactions.users_dict.user_name:”name” | document.reactions.users:WJF981Z7U document.reactions.users_dict.user_name:”john doe” | Match reactions made by a specific user id Match reactions made by a specific user name |
Searching For @ Mentions Within Messages
When a Slack user mentions another user in a message, e.g.
Hey @Steve did you notice the latest stock price trends?
That mention is stored in the message as the target user’s (Steve’s) Slack User ID e.g. U123456789.
To search for @ mentions in messages you can use the target user’s Slack ID in a text search, e.g.
text:U123456789
This can be combined with other metadata search terms, e.g. @ mentions of “Steve” by a particular user.
user_id:W0987654321 AND text:U123456789
Long-form Metadata Terms for Use with Visual Analyser
Query syntax used by Visual Analyser is slightly different to the syntax traditionally used in View Discovery. However, the Visual Analyzer syntax can also be used in View Discovery. So if you intend to move into Visual Analyzer after crafting your query, it is recommended to use these long-form keywords in View Discovery also.
Note: If you do not use the long-form syntax of the metadata term within Visual Analyzer, the Heatmap Tab, the Channels Tab and the Facet selectors will appear to be empty.
Metadata | Standard Syntax | Long-form Syntax |
---|---|---|
User Name | user_name:”john doe” | skeleton_user_name:”john doe” |
user_email:”john.doe@client. com” | skeleton_user_email:"john.doe@acme.com" | |
User ID | user_id:WJF981Z7U | skeleton_user_key:WJF981Z7U |
Channel Name | channel:”random” | skeleton_channel_name:”random” |
Channel ID | channelid:C05F6CKKL59 | skeleton_channel_key:C05F6CKKL59 |
Team Name | team:"Hanzo Team" | skeleton_team_name:"Hanzo Team" |
Team ID | teamid:TVGH04RV89 | skeleton_team_key:TVGH04RV89 |
Edited or Deleted messages | msg_edited | document.subtype:message_changed |
File type | filetype:pdf | document.children.files.files.filetype:pdf |
File name | filename:summer.png | document.children.files.files.name:summer.png |