Disco Search Manual / Desk Reference

DISCO uses Boolean search operators and are not case sensitive. We recommend you use this guide as a resource to reference these operators as well as the different search terms syntax available for use to filter or expand your search results.

CLICK HERE to print a condensed Search Desk Reference Guide. This guide explains how to search in DISCO.


Search Bar Operators

Operators Description
&, and

Includes results with both terms

Example: contract & payment — Documents that contain both contract and payment

(space), or

Includes results with either terms or fields

Example: contract payment — Documents that contain contract or payment

%, not

Excludes term or field from results

Example: contract % payment — Documents that contain contract but not containing payment


Proximity search, searching within n words

Example: contract /10 payment — Documents that contain contract and payment within ten words of each other (in any order)

“ ”

Exact phrase intended

Example: “contract payment” — Documents that contain the exact phrase contract payment


Truncation search or root expander

Example: contract! — Documents that contain any term starting with contract, for example, contract, contracts, contractual, contracting, or contracted


Wildcard search for single character

Example: contract* — Searches for words that have one — but only one — character after contract, such as contracts, but not contracted, contractual or contract


Fuzzy or approximate word search

Example: guaranty~ — Searches for guaranty, guarantee, garantee, garanty, and similar (mis)spellings

( )

Grouping syntax

Example: (failure & consideration) & (contract agreement) — Documents must contain both failure and consideration and the results must have either contract or agreement

sample(n, search)

Returns n documents randomly selected from results of search. If n is less than 1, this number is treated as a percentage.

Example: sample(.5, contract) — Returns 50% of the search results for contract at random.

sample(700, contract) — Returns 700 randomly selected documents from the search results for contract.


Field searching (see below for standard DISCO fields)

Example: custodian(Holcombe)Holcombe in the custodian field

Standard Document Fields

To search a specific field use document text, document notes, and document metadata fields, such as custodians, authors, subject, to, from, cc, and bcc. Otherwise, searches can be directed to the following fields, included here with search examples:

Document Identification

Command Description

Field of Bates numbers applied to documents (either from DISCO production or from elsewhere)

Examples: batesnumber(Enron000009) — A document receiving the Bates stamp Enron000009

batesnumber(Enron000007 to Enron000950) — Documents with Bates numbers within the identified range


English portion of the Bates stamp

Example: batesprefix(Enron) — Documents that use Enron as a Bates prefix


Identification number assigned by DISCO which is unique to each document in the database

Example: id(1200) — The document with DISCO identification number 1200


Name or Number assigned to each set of documents produced using DISCO

Examples: production("defense") — Documents produced in the production set "defense"

production(productions/2) — Documents produced in the second production set


Number assigned to each group of documents ingested into DISCO

Example: ingestsessionid("IngestSessions/1") — Documents ingested into DISCO in Ingest Session 1


Optional identification number users can assign (contact DISCO Support to do so)

Example: referenceid(245) — Document with Reference ID number 245

DISCO User Created Information

Command Description

The document note field is appended to documents manually by DISCO users and fully searchable after creation

Example: documentnote(hot) — Documents with hot in the document note field


Custom metadata field added by admin level users and is used to capture additional information

Examples: fields(important) — Documents with important in any Field

more about custom fields


Folder created in DISCO by a user

Examples: folder("Hot Documents") — Documents in the DISCO folder "Hot Documents"

folder("Hot Documents/Experts") — Documents in the subfolder "Experts"

folder("Hot Documents/!") — Documents in folder "Hot Documents" and all subfolders


Privilege Note is a user created field that will appear on privilege logs (such as a reason for the privilege assertion)

Example: privilegenote("Legal Advice") — Documents using the phrase "Legal Advice" inside the privilege note


Redaction reasons are optional user-created text that can overlay redactions when produced

Example: redactionreason("Trade Secret") — Documents with "Trade Secret" applied as a redaction reason


A "review stage" is a set of documents created by users for linear review

Example: stage("First Pass Review") — Documents in the stage "First Pass Review"


Documents in stages are pulled by a reviewer in "batches"

Example: stagebatched("First Pass Review") — Documents in the stage First Pass Review that have been placed in batches (whether or not yet reviewed)


After documents are marked "reviewed" in a stage, they are complete

Example: stagecomplete("First Pass Review") — Documents in the stage "First Pass Review" that have been marked reviewed (i.e., complete)


Tags are user-added fields appended to documents by users

Example: tag(responsive) — Documents with the tag "responsive"

Document Metadata Fields

Command Description

Metadata field identifying the author or creator of a file (note: does not include the sender of an email)

Example: author(Jones) — All documents which "Jones" authored


Metadata field for a recipient that was "blind copied" (or "blind carbon copied") on an email

Example: bcc(Frank) — All emails where "Frank" (first or last name) is blind copied


Metadata field for "copied" (or "carbon copied") on an email

Examples: cc(Thomas) — All emails where "Thomas" (either as a first or last name) is copied

cc("Frank Thomas") — All emails where "Frank Thomas" is copied


Metadata field of a custodian (typically the individual or location from which a document was collected)

Example: custodian(Peterson) — All documents where "Peterson" is in the custodian name field


Metadata field of an exact custodian name

Example: custodianexact("Andrew Lewis") — All documents where exactly "Andrew Lewis" is the custodian


Metadata field of an email domain

Example: domain( — Returns all emails sent to or from email addresses (also including cc and bcc fields) having "" as the domain (e.g.,


This is a metadata field of any folder from where a document was saved (such as computer or network drive)

Example: folderpath("Deleted items") — All documents that were in the "Deleted Items" folder when collected (note: this search locates any discrete folder within the tree of folders and subfolders (e.g., MyComputer/Files/DeleteItems)


Metadata field identifying the sender of an email

Example: from(Lee) — All emails sent by "Lee"


Metadata field searching the subject (or "re" line) of an email.

Example: subject(meeting) — All emails with "meeting" in the subject lines.


Text in DISCO is the OCR (extracted text) information in an image

Example: text(Peter) — Documents containing "Peter" anywhere within the image (note: this does not search metadata)


Metadata field identifying to whom an email was sent (excludes the cc and bcc fields)

Example: to(Duncan) — All emails where "Duncan" (either as a first or last name) was in the "to" field
to("Duncan Kennedy") — All emails sent to "Duncan Kennedy"


Recipient searches the combined email metadata fields to, cc, and bcc (i.e., anyone who was a "recipient" of an email)

Example: recipient(Jones) — All emails where "Jones" appears in the metadata of the to, from, or bcc fields

Document Attributes

Command Description

Returns all "parent" documents that have the specified number of "children" 1

Example: childcount(2) — All emails or other documents that have two children (such as attachments or embedded files)
childcount(1 to 1000) — All emails or other documents that have between 1 and 1000 children


Returns all emails belonging to "conversations" that contain the number or range of emails specified 2

Example: conversationcount(3) — All emails that contain three emails within the conversations
conversationcount(3 to 15) — All emails that contain between three and fifteen emails within the conversations.


This returns files corresponding to the specified size of the file (in bytes)

Example: filelength(25000) — All documents that are exactly 25,000 bytes
filelength(1 to 100000) — All documents with file sizes between 1 and 100,000 bytes


Filename of any document (note: emails often have filenames, though largely hidden in most applications, so consider excluding that type if desired)

Example: filename(Agenda.pdf) — All documents with the exact filename "agenda.pdf"
filename(Agenda!) — All documents that begin with "Agenda" in the filename (e.g., Agenda.pdf; AgendaForMay11.word; or Agenda for Meeting.ppt)


Returns documents containing the specified number of pages in an image

Example: pagecount(1) — All documents that have one page
pagecount(101 to 3000) — Documents whose image has between 101 and 3000 pages


Returns all documents with the specified number or range of "parents" 1

Example: parentcount(1) — All "children" (such as attachments or embedded files) that have only one parent
parentcount(0) — Returns only "parents" (i.e., excludes all attachments and embedded files)


Location from which the document was collected

Example: path("My Computer/Deleted Items/!") — Returns all documents that were saved, when collected, in the folder "My Computer/Deleted Items" as well as all documents in subfolders.


Returns documents with specified number or range of characters in the text of an image (includes spaces)

Example: textlength(3000000) — All documents with 300,000 characters in the text


The "type" of a document in DISCO is the file type (e.g., email, word, pdf, audio, excel, video, text, etc.)

Example: type(word) — All files of type "word"
type(email) — All emails


Searches whether "hidden" data is in a file, including comments, revisions, notes, hidden sheets, or very hidden sheets (note: users must specify type)3

Example: hiddentype(revisions) — All documents with hidden revisions


  1. A "child" is (typically) either an attachment of an email or an embedded file in a document. A "parent" is the email containing the attachment or the document containing the file.
  2. Conversations include the various responses, replies and forwards of an email chain.
  3. Choices include revisions, hidden sheets, very hidden sheets, comments or notes

Date Fields

Dates can be searched by date certain (e.g., 12/10/2015); month and year (9/2016); or year (2012).

  • date( )
  • alldates( )
  • createdate( )
  • familydate( )
  • lastmodifieddate( )
  • loaddate( )
  • receiveddate( )
  • senddate( )

Range Searches

Use "to" to search for a range, for example: date(10/16/2015 to 12/10/2015).

  • id(
  • date(
  • batesnumber(
  • childcount(
  • conversationcount(
  • filelength(
  • instancecount(
  • pagecount(
  • parentcount(
  • similarcount(
  • textlength(

All date searches have the additional range options to search before or after a date (e.g. date(before 12/2000)).

  • date(before...)
  • date(after...)

Tag Fields*

Tagging decisions can also be searched by dates applied and users applying them, using the syntax below:

Command Description
tag(by Documents tagged by
tag(responsive & by Documents tagged responsive by
tag(non-responsive % by Documents tagged non-responsive by anyone other than
sample(10, tag(by Ten random documents tagged by
tag(by & on 10/16/2015) All documents tagged by on 10/16/2015
tag(by & after 10/16/2015) Documents tagged by after 10/16/2015
tag(responsive & by & before 10/16/2015) Documents tagged responsive by before 10/16/2015
removedTag(responsive) Any documents from which the responsive tag was removed (by anyone)
removedTag(by Any documents from which any tags were removed by
* % tag(!) All documents that have zero tags associated

*The tag(by) search syntax is available for new matters only as of 10/05/15.

True/False Fields

Command Description
hasprivilege(true|false) true if document has at least one privilege tag
hasredaction(true|false) true if document is marked for redaction in DISCO
hasdocumentnote(true|false) true if document has a DISCO user-created note
hasredactionreason(true|false) true if document has a reason for redaction
hasredactionwithoutreason(true|false) true if document is redacted without a stated reason
unfoldered(true|false) true if document is not in any folder
hashiddentype(true|false) true if document has a hidden file type
hasFields(true|false) true if document has contents in any Custom Fields


DISCO also allows administrators to define their own Fields that can then be used in DISCO searches. Fields also support wildcards and true/false syntax. 

Example Description
deposition(important) Documents with the word important in a Field named Deposition
"My thoughts"("very important")
or My_thoughts("very important")
Documents with very important inside the My Thoughts field
or hasDeposition(true)
Documents with any contents in a Field named Deposition
has”PSL Notes”()
or has”psl notes”(true)
Documents with any contents in a Field named PSL Notes
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request