Cisco Cisco Content Security Management Appliance M1070 Mode D'Emploi
6-7
AsyncOS 8.2 for Cisco Content Security Management User Guide
Chapter 6 Tracking Email Messages
Narrowing the Result Set
After you run a query, you might find that the result set includes more information than you need. Instead
of creating a new query, narrow the result set by clicking a value within a row in the list of results.
Clicking a value adds the parameter value as a condition in the search. For example, if the query results
include messages from multiple dates, click a particular date within a row to show only messages that
were received on that date.
of creating a new query, narrow the result set by clicking a value within a row in the list of results.
Clicking a value adds the parameter value as a condition in the search. For example, if the query results
include messages from multiple dates, click a particular date within a row to show only messages that
were received on that date.
Procedure
Step 1
Float the cursor over the value that you want to add as a condition. The value is highlighted in yellow.
Use the following parameter values to refine the search:
•
Date and time
•
Message ID (MID)
•
Host (the Email Security appliance)
•
Sender
•
Recipient
•
The subject line of the message, or starting words of the subject
Step 2
Click the value to refine the search.
The Results section displays the messages that match the original query parameters and the new
condition that you added.
condition that you added.
Step 3
If necessary, click additional values in the results to further refine the search.
Note
To remove query conditions, click Clear and run a new tracking query.
Understanding Tracking Query Results
If results are not what you expected, see
.
Tracking query results list all of the messages that match the criteria specified in the tracking query.
Except for the Message Event options, the query conditions are added with an “AND” operator. The
messages in the result set must satisfy all of the “AND” conditions. For example, if you specify that the
envelope sender begins with
Except for the Message Event options, the query conditions are added with an “AND” operator. The
messages in the result set must satisfy all of the “AND” conditions. For example, if you specify that the
envelope sender begins with
J
and you specify that the subject begins with
T
, the query returns a message
only if both conditions are true for that message.
To view detailed information about a message, click the Show Details link for that message. For more
information, see the
information, see the
.
Note
•
Messages with 50 or more recipients will not appear in tracking query results. This issue will be
resolved in a future release.
resolved in a future release.
•
You can choose to display up to 1000 search results when you specify your query. To view up to
50,000 messages that match your criteria, click the Export All link above the search results section
and open the resulting .csv file in another application.
50,000 messages that match your criteria, click the Export All link above the search results section
and open the resulting .csv file in another application.