Cisco Cisco Email Security Appliance C170 사용자 가이드

If necessary, refine the search by entering new search criteria, and run the query again. Alternatively, you 
can refine the search by narrowing the result set, as described in the following section.

After you run a query, you might find that the result set includes more information than you need. Instead 
of creating a new query, you can narrow the result set by clicking a value within a row. Clicking a value 
adds the parameter value as a condition in the search. For example, if the query results include messages 
from multiple dates, you can click a particular date within a row to show only messages that were 
received on that date. 

To narrow the result set:

Float the cursor over the value that you want to add as a condition. The value is highlighted in yellow. 

You can use the following parameter values to refine the search:

Date and time

Message ID (MID)

Sender’s username

Sender’s domain

Recipient’s username

Recipient’s domain

Subject line of the message

Click the value to refine the search.

The Results section displays the messages that match the original query parameters and the new 
condition that you added.

If necessary, click additional values in the results to further refine the search.

To remove query conditions, click the Clear button and run a new tracking query.

Tracking query results list all of the messages that match the criteria specified in the tracking query. 
Except for the Message Event options, the query conditions are added with an “AND” operator. The 
messages in the result set must satisfy all of the “AND” conditions. For example, if you specify that the 
envelope sender begins with 

J

 and you specify that the subject begins with 

T

, the query returns a message 

only if both conditions are true for that message.

For each message, the following information is shown: Date/Time, Sender, Recipient, Subject, Last 
State, IronPort message ID (MID), and the names of any attachments. To view detailed information 
about a message, click the Show Details link for that message. For more information, see 

The Security Management appliance returns up to the first 10,000 rows of data. To access additional 
records, adjust the query parameters and run a new query.