Narrowing the Result Set

After you run a query, you might find that the result set includes more information than you need. Instead of creating a new query, narrow the result set by clicking a value within a row in the list of results. Clicking a value adds the parameter value as a condition in the search. For example, if the query results include messages from multiple dates, click a particular date within a row to show only messages that were received on that date.

Procedure

Step 1

Float the cursor over the value that you want to add as a condition. The value is highlighted in yellow.

Use the following parameter values to refine the search:

  • Date and time
  • Message ID (MID)
  • Host (the Email Security appliance)
  • Sender
  • Recipient
  • The subject line of the message, or starting words of the subject

Step 2

[New Web Interface Only] In the Message Tracking search criteria, click Modify.

Use the following parameter values to refine the search:

  • Date and time

  • Message ID (MID)

  • Cisco Host (the Email Security appliance)

  • Sender

  • Recipient

  • The subject line of the message, or starting words of the subject

  • Message Event

  • Additional Details (Message Last State, SBRS, Sender IP, and Group)

Step 3

Click the value to refine the search.

The Results section displays the messages that match the original query parameters and the new condition that you added.

Step 4

If necessary, click additional values in the results to further refine the search.

Note
To remove query conditions, click Clear and run a new tracking query.