Search to/from a user but exclude one domain

[NJBird1427]

Hello. I need to conduct a search for all emails to/from one user in our system but need to exclude emails to/from internal users. For example, I need all emails to/from John.Doe@domain.com (that's easy) but I need to exclude anything that was sent or received from other users in @domain.com. Does that make sense? I've never done a search like this. Any guidance would be appreciated.

[EV_Ajay]

Hi,

Our DA & EV Servers present in domain.com. The user 'John Doe' is also present in domain.com.

It means any email sent from John or any email received to John must have domain.com present.

You want all emails to/from John but don't want email sent/receive from other users in domain.com.

Please brief me more on this issue with example.

Is it means you want such emails which sent from and received to John. Means John sent email to himself and does't have any other recipient ?

Still i create one search criteria might it help you.

[NJBird1427]

Yes. EV and DA servers are both in domain.com. The user is also in domain.com. I need everything the user sent or received but only from senders or recipients who are NOT in domain.com.

[NJBird1427 · Accepted solution]

I ended up opening a case with Symantec for this since I needed the answer for a complex and tedious search. Posting the solution that Symantec provided. Maybe it will help someone else in the future. In Discovery Accelerator, use the Custom Attribute Vault.MsgDirection. Value would be 2 3. That would find all inbound and outbound external mail.

[EV_Ajay]

Hi,

Thanks for your reply.

I found following techntoe about the same.

How to find emails tagged by message direction using Enterprise Vault (EV) advanced web search or Discovery Accelerator (DA) search.

http://www.symantec.com/docs/TECH58712