This guide will help you get familiar with searching your Slack datasource. Need help finding specific channels or direct messages by a specific user? We'll have you covered.
First make sure you are familiar with our search capabilities to get the most out of your Slack searches:
When performing searches your datasource must be specified when executing your query. For basic searches this is achieved by navigating into the source and performing the query. Since advanced searches query across the entire Onna account the Resource field Parent source name should be specified:
Advanced Search Field Summary
The main fields used for advanced searching in Slack are Conversation Name and Conversation Type. Conversation ID is optional. This field is a unique text identifier for the conversation.
Another useful option is Related Users Names. This will be a list of Slack user names that are associated with conversations.
Conversation name formats
- Channel #channel_name - public channel name format
- Private channel #channel_name - private channel name format
- Personal messages - static label for direct messages between two users
- Direct message - static label for multi-party messages with more than two people
- channels - public channels
- groups - private channels
- dms - direct messages (between two users)
- mpim - multi-party messages (between more than two users)
Note: When searching for conversation types dms or mpim, the Slack workspace name cannot be included in the advanced search. Direct messages and multi-party messages are at the enterprise account level. Only public and private channels are associated with a workspace.
Basic Channel Searching
To search for a specific channel, surround your channel search with double quotes. For example searching for "Channel #news" will return conversations from the #news Slack channel. If you need to find a private channel querying "Private channel #name" returns conversations from the specified private channel.
Advanced Channel Searching
For advanced search you want to utilize the Conversation field Conversation name. This specifies the name of the channel. If you need to find all conversations from channel #news add Conversation name contains Channel #news to the query:
Again for private channels use Private channel #name.
Another scenario is obtaining all direct or personal message channels for an account. To obtain these conversations you can run a search on Conversation Type that looks for the values dms and mpim:
Basic User Searching
To find conversations related to specific users try the @ symbol to query a user name. For example if you need conversations associated with John Smith you can use @"John Smith"
Another option is to use the discussion filter and select a participant. Click on the filter toggle on the top right corner of the page:
This opens the filter panel on the left side of the page. Next click the gear at the bottom of the filter panel to customize your filters:
This displays the options to include in your filter panel. For Slack Enterprise searching, make sure to select Participants, Channels, Slack Workspaces (if you have multiple workspaces). Click save and then you will be able to filter based on these fields.
Advanced User Searching
Advance searching for users is associated with RelatedUsers field Related Users Name. For example to query for John Smith you can execute where Related Users Names contains John Smith:
Another scenario is finding any personal messages where a user is involved. In this case you add Conversation Type to the query and use the direct/multi-party search terms (dms,mpim):
More Useful Searches
Users in Multi-Party Messages
If you need to find conversations between multiple users we can utilize the @user search with keyword "Direct message". Here is an example that finds messages between John, Jane and Onna:
Additionally conversation names will always be formatted the same when collected. In this example the wording "Direct message" will always be the start of the conversation name, followed by the names of the users in alphabetical order. So another method to find conversations between these three users is:
Note: With multi-party message searching Onna is overly inclusive. This means there may be multi-party messages that include other users that were not part of your search parameters.
Conversations Between Specific Dates
When attempting to find conversations within certain date ranges, you can query on the file creation date. The creation date of the conversation file is the date the conversation started. When conducting a basic search you can use the after and before modifiers and try something like:
This includes conversations that happened between Dec 2nd 2019 and Dec 10th 2019. If you want to filter this down further and specify a user you can make the following addition:
Now we have conversations between those dates where Slack user John Smith was involved. Additionally the filter functionality includes specifying a range of Creation Dates. If you open the filter option you will find you can pick Creation Dates to get the same result as above:
The same searches can also be done through Advanced Search. When using advanced search you can query on the Metadata field File creation. Using the above example, if I want to find conversations between Dec 2nd 2019 and Dec 10th 2019 involving John Smith the advanced search query would look like:
Find Edits or Deletions
Slack channels in Onna have the labels "Has Edits" or "Has Deletions" if a user edited or deleted text/attachments in a conversation. This provides a way to easily find what conversations have edited or deleted information:
In the basic search bar a simple query like "Has Edits" OR "Has Deletions" will provide all conversations that have modifications. To narrow it down to edited conversations associated with a specific user you can include @username to the query - @"John Smith" AND ("Has Edits" OR "Has Deletions"):
To find conversation edits in advanced search use the Metadata field Extracted text. Using the same example as above with John Smith:
Modified or deleted messages and images can easily be seen by viewing the conversation and looking for green/red highlights and the edit/delete icons next to the message:
Note: if a conversation has the phrase has edits or has deletions within them these will also be matched.
Searching For Files
To see all files posted in a Slack account, search for where Conversation type is not set. By setting this the results bring back non-conversation type files which are the file attachments posted in messages:
To return files posted in specific channels specify the Resource field parent_title. The channel name is considered a parent to the file posted in the conversation. Here's an example that returns files from the channels #random and #news:
One more scenario you will run into is obtaining files posted by a specific user. This is achieved by specifying the Metadata field author. The author value should be set to the Slack user name when conducting the search:
If you need to find files within a specific date range then you can add the the Metadata data field File Creation to your query.
Users Who Joined Or Left Channel
Before you attempt to search for users that joined or left channels you need to determine if this data is available within your Slack account. If you are on a Free, Standard, or Plus plan then these messages are available depending on the administration settings:
By default, messages are shown when someone joins or leaves a channel. Smaller groups might find these messages helpful, but larger groups might prefer to hide them.
For users syncing a Slack Enterprise Grid plan it is not possible to manage join and leave messages and only join messages will display:
On Enterprise Grid, it's not possible to manage join and leave messages. Messages will only show when someone joins a channel — leave messages will not display at any time.
More information can be found on Slack's Workspace Administration guide.
If these messages are available to you they will be in the following format:
- private channel - @User has left the group
- public channel - @User has left the channel
- private channel - @User has joined the group
- public channel - @User has joined the channel
By replacing @User with the person's username you can easily do basic searches using the formats above:
To achieve an advanced search you can try the above formats using a contains with the Metadata field Extracted text:
If I include the property of ‘Author’ in my advanced search can I also search against ‘Conversation type’?
No, conversation type should not be included since the property of Author will only return files and will not show the parent source of the files as a result. An export of the search can be performed in order to view the conversation type of the search results.