Investigations
      Back to home
      1. Help Center
      2. CloudNine Analyst
      3. Investigations

      CloudNine Analyst: Search Functions in CloudNine Analyst

      Overview of Search Types

      Navigation

      To view CloudNine Analyst's various search types, select a project from your project dashboard and click on "Review Project Metadata."
       
      While in Review Project Metadata, click on the word Search in the Filters box.

       Search Fields

      All searches identify hits from the 24-hour thread or document title, subject, body, translated text, or attachment content fields. 

      Partial Words

      Use wildcards * and ? to perform partial word searches. 

      Note: Enhancements to search indexes were implemented in December 2022 to require the use of wildcards for partial word search. 

      Projects created before December 2022 may return partial word results without the use of wildcards if  All of the words/phrases options are selected. For example, a search for the term less would return hits such as careless, useless, lesson, lesser,  lessor, careless, etc. 

      If your project was created before December 2022, contact support@cloudnine.com to have your project re-indexed to implement the search enhancements. 

       
       Case Sensitivity
      All search types are case-insensitive. For example, if you type the term US, you will see search hits that show the word both capitalized and uncapitalized - us and US.
      When a term is case-sensitive, such as initials or abbreviations, wrap the search term in quotes. For example, a search for "US" should return records that have upper case US only in the 24hr thread, title, subject, body, translated text, or attachment content fields. 

      Note: Case sensitivity improvements were implemented in Version 2022.12.002. If your project was created earlier than December 2022 a re-index will need to be completed. Please contact CloudNine support at support@cloudnine.com.

       

      Proximity Between Words

      Proximity searches allow you to search for quoted words that may be separated by other words.
       
      Example:  "case files" ~5
      This search will look for matches where the quoted words are within 5 words of each other.
      Note: Full Query String also supports proximity using the following example: case /5 files
       
       

      Wildcards

      ? - Question marks are used for single-character wildcards. The question mark must be placed in the position of the letter that it will replace. For example, searching ba? will show results for bat, ban, bag, and bay.
       
      * - Asterisks represent multi-character wildcards. Searching for wh* will show results such as the wheel, while, and whatever.
       
      Wildcards are not supported in quoted text or in the search type Has the Word or Phrase.

      Also, wildcards cannot be mixed with fuzziness.
       
       

      Special Characters

      Special characters are not supported by Has the Word or Phrase and Start With/Ends With the Word searches.

      Full Query String, Has Any of the Words (OR), and Has All of the Words (AND) support both single and multiple character wildcards.
       
      The following characters can be used for single query searches (OR/AND) and full query searches: 
      +      -      =
      &     ~      !      *
      ?      :      ^      "
      { }      (  )      | |
      \ /      > <      [ ]
       
      | signifies OR operation
      " wraps a number of words to signify a phrase
      * at the end of a term signifies a wildcard search
      ( ) subsets of words or phrases strung together through AND or OR operators e.g. (wood OR water) AND (ground OR forest)
      Parentheses are only supported in Full Query searches.
       
      +word, a plus sign in front a word signifies that the word must be included.
      -word, a minus sign in front of a word signifies that the word must not be included.
      + and - cannot be used with Has Any of the Words (OR), and Has All of the Words (AND)
       
       
      Regular Expression searches support the following characters:
      .       ?       +
      *      |      { }
      [ ]      ( )      "
      \      #      @
      &      < >      ~
       
      For more information on Regular Expression syntax, visit these articles:

      https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html

      https://support.esianalyst.com/portal/en/kb/articles/search-options-available-in-esi-analyst

       

      Wrap Word Sets in Parentheses.

      Phrases can be wrapped within parentheses through quote marks.
      Example: (laptop AND passwords) OR (Snapchat AND Facebook AND Gmail)
       

      Wrapping Phrases in Quote Marks

      Wildcards are not supported within quoted phrases.
      Example: "confidential information"
       

      Boolean Operators

      The Boolean operators OR and AND must be written between two or more words in capital letters.
      Example:
      Facebook OR Twitter
      Snapchat AND Instagram
       
      Boolean operators only work in the Full Query String, Has Any of the Words, and Has All of the Words searches.
       
       

      Fuzziness

      Fuzziness is supported by each search type. The feature is used for misspelled words or rearranging words (~N). The N represents a number.
       
      ~N after a word signifies the number of characters that a search result can vary by. The fuzziness can not be greater than five characters.
      Example: misspelled ~5
       
      Fuzziness is only supported in Full Query String, Has Any of the Words, and Has All of the Words searches.
       
       

      Slop

      ~N after a phrase signifies the number of words that can separate a quoted search phrase.
      Example: "steal files"  ~3
       
      Mixing fuzziness and wildcards is not supported.
       
       

      Explanations for Each Search Type