Performing Advanced Search and Query Search
Insight eDiscovery provides the Advanced Search and the Query Search features to search the content within archived accounts and cases. Both the search features are available in the Investigations tab (where you can search your own account or the accounts that you manage) and the eDiscovery tab (where you perform searches of the custodian accounts within cases).
Advanced Search support the use of phrase search, Boolean operators, proximity search, and wildcard search. See Search syntax for Advanced Search.
Performing an advanced search
To perform an advanced search
-
Access the Advanced Searchtab from theInvestigationor theeDiscovery tab.
-
Specify the following inputs:
Custodians - Select All to search archives of all of the custodians that are associated with the case. - Select Custom to search archives of the particular custodians. The Manage button appears. Click Manage to open the Add/Remove Custodians . Expand Selected Custodians to view the custodians selected for this search. Expand Manage Custodians and select the custodians required for this search. Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section. Custom Headers Note: TheCustom Headersoption does not appear if there is no entry for a custom header for a particular group or tenant in database. Custom header does not work independently. You need to use the filter criteria to search the required items. Expand Custom Headers and set the header operator values. - Click + to add new search clauses. - Click - to remove search clauses that are not required. - In the first column, select the required header you want to search for. Based on the data type you have selected, the operator changes. For example, if you have selected the receiver date in header, the operator values can be Between , Before inclusive and After inclusive . For a numeric or integer header value, the operator values can be Is equal to , Less than , and Greater than . If you have selected a string value in header, then the operator will be Contains . - In the second column, select the available operator. - In the third column, specify the text, phrase, or date that you want to search for. Filters Expand Filters and set the filter operator values. The operators are explained in a table below. - Select All to match all conditions you have provided. - Select Any to match any of the conditions you have provided. - Click + to add new search clauses, and complete a new row for each clause. - Click - to remove search clauses that are not required. - Searches are not case-sensitive. The search supports phrase search, Boolean operators, proximity search, and wildcard search. See Search syntax for Advanced Search .
The Filter operators are listed below:
| Message | Entire Message | Contains / Doesn't Contain |
|---|---|---|
| Subject + Body | Contains / Doesn't Contain | - |
| Subject | Contains / Doesn't Contain | - |
| Body | Contains / Doesn't Contain | - |
| Inbound Message (AND) | Yes / No | - |
| Outbound Message (AND) | Yes / No | - |
| Internal Message (AND) | Yes / No | - |
| Note: In Advanced Search , this option filters and retrieves only internal messages exchanged within the same organization. | ||
| Is Hidden | Yes / No | - |
| IP Header | Contains / Doesn't Contain | - |
| Date Sent/Modified(AND) | Is Equal To | Select a date |
| Date Sent/Modified(AND) | Before | Select a date |
| Date Sent/Modified(AND) | After | Select a date |
| Date Sent/Modified(AND) | Within Range | Select a date range |
| Participants | All Senders and Recipients | Contains / Doesn't Contain |
| Participants | Senders Only | Contains / Doesn't Contain |
| Participants | Recipients Only | Contains / Doesn't Contain |
| Participants | To/Cc | Contains / Doesn't Contain |
| Participants | To | Contains / Doesn't Contain |
| Participants | Bcc | Contains / Doesn't Contain |
| Classification | Classified As | Contains / Doesn't Contain |
| Note: This option is available if the Arctera Insight Classification service is enabled for a user. | Select a classification tag from the drop-down list. The list shows all the classification tags that have been applied to your company's messages in Arctera Insight Archiving. | |
| To see a tooltip with a classification tag's description, select the classification tag from the drop-down list and then point to the classification tag. | ||
| Classification | Sentiment Score | Is Equal To / Below (Inc.) / Above (Inc.) |
| Note: This option is available if the Arctera Insight Classification service is enabled for a user. | ||
| Attachment | Has Attachment | Yes / No |
| Attachment | File/Attachment Name | Contains / Doesn't Contain |
| Attachment | File Attachment Type | Contains / Doesn't Contain |
| See Searchable attachment types . | ||
| Archive Date | Is Equal To : Finds items archived on a specific date. | Select date. |
| Filter archived data based on the date when emails, collaboration items, or files were archived. | Before : Finds items archived before a certain date. | Note: Use this filter only for the data archived after January 2021. Data before January 2021 will not appear in filtered results. |
| After : Finds items archived after a certain date. | Tip : If you want to use Query Search instead of Advanced Search, use the ArchiveDate: term and then build the search criteria. | |
| Within Range : Finds items archived between two chosen dates. | ||
| Source Type | Is : Filters results that match the selected source type(s) | Select one or more sources as needed. |
| Is Not : Excludes results that match the selected source type(s). | ||
| Department | All Senders & Recipients : Filters data where both the sender and recipient belong to the selected department(s). |  Select Any or All operator and then click Select Department . |
| Note: This option is available if the Arctera Insight Surveillance service is enabled for a user. | Senders Only : Filters data where only the sender belongs to the selected department(s). | A dialog box opens where you can choose one or more departments to apply as a filter. |
| Recipients Only : Filters data where only the recipient belongs to the selected department(s). | 1. Use the Search Departments field to quickly locate a department by name. | |
| 2. Toggle the Use Inheritance to include child departments of a selected parent department. | ||
| 3. Click Select All on Current Page to select every department visible on the current page. Else, select the required departments individually. The count of selected departments appears in the bottom of the dialog box. | ||
| 4. Click Select to confirm and apply them as a filter. | ||
| If you want to reset your choices, click Clear Selection . If you want to close the dialog without saving changes, click Cancel . |
-
Click Search.
You can perform a new search and optionally save it, or you can view the results of a previously saved search.
Important!
-
In Advanced Search, the search text input functionality is updated. In previous releases, when users were providing multiple text input with space, the default logical operator "AND" was getting applied. From now onwards, the default logical operator "OR" is getting applied to get user records.
This operator change from "AND" to "OR" is applied to all kind of searches. If users have previously used spaces while providing the search text inputs, their saved records (saved searches/standard searches/Ongoing searches) will be impacted as the operator is changed from "AND" to "OR".
-
Based on the selected attributes, when you export the search report, the Search Summary and Search Report is generated as shown in the sample image below.
Performing a query search
To perform query search
-
Access the Query Searchtab from theInvestigationor theeDiscovery tab.
-
Specify the following inputs:
Custodians - Select All to search archives of all of the custodians that are associated with the case. - Select Custom to search archives of the particular custodians. The Manage button appears. Click Manage to open the Add/Remove Custodians . Expand Selected Custodians to view the custodians selected for this search. Expand Manage Custodians and select the custodians required for this search. Click Update to add these selected custodians as a search input. These custodians are listed under the Selected Custodians section. Query Search Specify the search query by providing keywords. For example, if you are using the Source Type filter option, do the following as required: - To filter items from one source type, type a query as SourceType: "". Example :SourceType: "Exchange"- To filter items from multiple source types, type a query as SourceType: ("" and ""). Example ,SourceType: ("Exchange" OR "Citrix")
Related information
Guidelines for specifying queries
The application supports query searches only if the following necessary conditions are followed. Else, the application displays corresponding errors.
| Conditions | Examples |
|---|---|
| - | The search criteria must be used after the operator and before the query text. |
| - | The AND/OR/NOT operators must be written in capital letters. |
| - | The AND/OR logical operator is missing. |
| - | The extra space(s) between operators is not allowed. |
| - | The space after bracket is not allowed. |
| - | The space before colon is not allowed. |
Operator-specific conditions Spaces-specific conditions
-
Click Search.
You can perform a new search and optionally save it, or you can view the results of a previously saved search.