Case Management Search when DLM is Disabled
Important
If Document Lifecycle Management is enabled, refer to Data Lifecycle Management (DLM) for the search behavior.
Choose from the topics below to understand what is Case Management search in Enterprise Archive.
What is Case Management Search?
Case Management Search involves searching for a specific conversation/set of conversation from the Case Management tab. Case Management search is present in both the Collect and the Review workspace.
Case Management Collect Search: Involves searching for conversations during case collection. The following actions can be performed from the Case Management Collect workspace:
Search for a conversation
Export conversation/conversation metadata content.
Collect and Apply holds to conversations.
Release held conversations.
Case Management Review Search: Involves searching for conversation while reviewing Case content. The following actions can be performed from the Case Management Review workspace.
Search for a conversation.
Export conversation/conversation metadata content.
Apply Holds and Tag collected content.
Release Held conversations.
Uncollect collected conversations.
How to access Case Management search?
Case Management search is accessible from the Collect and Review workspace and can be accessed by clicking on an existing case from the Case Management tab. A user should have access to the Case Management tab to perform any case related actions. Clicking either Collect or Review from the Case Research menu will open the Search workspace.
What are my searches based on?
Case Management Collect and Review searches are based on a conversation's
Archived Time: The date/time when the conversation was archived in Enterprise Archive.
Sent Time: The actual send date/time specified in the interaction.
What are the types of searches that can be performed?
The following types of searches can be performed from Case Management search:
Date Range
The Date Range filter present at the top of the search pane has the following default settings that auto-populate when searching in Enterprise Archive.
Timezone - GMT
Type - Sent Time
Range - Preselected as 12:00 AM to 11:59 PM for the previous day.
The filters are explained in detail below.
Searching by Date allows the user to search for the following Types of interactions:
Archived Time: The date/time when the interaction was archived in Enterprise Archive.
Sent Time:The actual send date/time specified in the interaction.
The date range filters are:
Time Zone - Select a time zone from the list of time zones provided in the drop-down.
Range– Select a range based on your preference for the interactions. The options provided are:
Between - Searches for interactions that were archived or sent between a time period.
After - Searches for interactions that were archived or sent after the selected time/date.
Before - Searched for interactions that were archived or sent before the selected time/date.
From– Select a From date and then select the start Time from when you want to list the interactions.
To– Select a To date and then select the end Time till when you want to list the interactions.
Words/Phrases
The Words/Phrases panel allows the user to perform simple keyword searches using the List of terms option, and advanced query searches using the Advanced Query option. The various searches that are supported for each search type are listed below.
Indexing Special Characters - Applies to List of Terms and Advance Query Search Types
The application search and indexing behavior is explained below and consists of the following components:
Enterprise Archive Index Store: Enterprise Archive indexes all the entries that a user can input. These entries are classified as keyword or text. Keyword entries are user inputs that should be searched as is, without analyzing them. Analyzing is the process of stripping (or transforming) user entries by tokenizing them, converting to lowercase, ASCII folded and so on. Text type fields are analyzed and any of the above actions are performed on them. Text fields refer to user content such as subject, body, and attachment text. All other user entries are keywords.
Querying the Enterprise Archive Index Store: Querying refers to searching for specific terms or phrases that are indexed. Anything that is not indexed cannot be searched in Enterprise Archive. Querying for special characters will not return any search results as the application analyzes text inputs and strips them of special characters.
List of terms
Select List of terms to perform simple keyword searches using the available filters as explained below:
The list of terms UI options are:
Must have all of these keywords: Using this search box returns search results containing all the specified keywords.
Must have at least one of these keywords: Using this search box will return search results containing any of the specified keywords.
Must not have any of these keywords: Using this search box will return search results not containing any of the specified keywords.
All the above search boxes contain an AND operator in between them.
To search for multiple words, enter the words in separate lines. A group of words in the same line will be treated as a phrase.
Reserved Words
The following words are reserved for application use, and will not be considered for their actual meaning when specified in uppercase format:
FOLLOWEDBY
NEAR
PRECEEDEDBY
NOTFOLLOWEDBY
NOTNEAR
NOTPRECEEDEDBY
EXCLUDING
List of Terms Search Behavior
The following rules are observed by the application while performing searches from the List of Terms field:
All extra white space is removed. For example: The sentence "insider trading details" will be analyzed as "insider trading details".
The list of stop words to be escaped can be custom defined by the customer.
Important
Enterprise Archive supports a maximum of 100 terms while using List of Terms search. A warning message will be displayed on using more than 100 entries.
Using Single/Double Quotes in Searches
Enterprise Archive search behavior with respect to the usage of single/double quotes is as follows:
A group of words in a single line with/without single/double quotes will be treated as a phrase.
A single sentence with/without quotes split into two separate lines will be treated two separate phrases.
Single/double quotes nested within a line will be ignored, and the entire line will be treated as a phrase.
The supported search types are as follows:
|
Search Type |
Syntax or Rules |
Example |
|
Simple Keyword Searches - Searches using specific terms in any of the List of terms filters are referred to as simple keyword searches. |
|
|
|
Phrase Searches - Searches using a specific groups of words in any of the List of terms filters are referred to as phrase searches. |
|
|
|
Proximity Searches - Searches for keywords or phrases occurring within a certain distance of each other can be performed along with the following proximity conditions:
|
The syntax for the proximity conditions are explained below:
where N is a numerical value, * allows wildcard searches for the attached word, | allows using more than one search term, ~ allows fuzzy searches for the attached word. |
|
|
Wildcard Searches - Search for multiple variations of a keyword using wildcard symbols. |
|
|
|
Important The application does not permit using wildcards (*,?) at the start of a search term as this can result in performance issues. There should be a minimum of 3 preceding characters to perform Wildcard searches currently, or the following error is displayed: "There should be a minimum of 3 characters before wildcard in 'List of Terms' section". |
||
|
Complex Searches - Complex searches can be performed by combining search terms and operators such as wildcard characters, fuzzy elements, and alternating characters. |
|
|
|
Regular Expression Searches - Search for a sequence of symbols or characters expressing a string or a pattern (regular expressions) like Social Security Numbers, Credit Card numbers, phone numbers, dates, IP Addresses and so on. |
|
|
Advanced Query
Smarsh recommends you to use the filters available on the search UI and List of Terms in particular to perform keyword based searches.
Advanced search must be used only when the above does not fulfill the user's requirement. Users must be familiar with Lucene syntax to form accurate, and specific queries to avoid inconsistent results.
Enterprise Archive supports a maximum of 1023 terms while using Advanced Query search. A warning message will be displayed on using more than 1023 terms.
Select Advanced Query to perform advanced searches using Boolean operators.
The types of Advanced searches that can be performed are explained in the table below:
|
Search Type |
Syntax and Rules |
Example |
|
Boolean Searches - Boolean operators allow terms to be combined through logical operators and grouping or phrase concatenation. Boolean search operators allow you to create advance search queries to include or exclude specific words. Boolean search provides the following search operators:
The OR operator is the default conjunction operator. This means that if there is no Boolean operator between two terms, the OR operator is used. |
|
|
|
Phrase Searches - Searches using specific phrases by enclosing the terms within double quotes. Multiple phrases can be combined using the above-mentioned Boolean operators. Without quotes, the search will treat each word as an individual search item. |
|
|
|
Proximity Searches - Search for specific terms or phrases occurring within a certain distance of terms or a phrase by mentioning a proximity value and using the '~' symbol. |
|
|
|
Wildcard Searches - Search for multiple variations of a keyword using wildcard symbols. |
|
|
|
Important Currently, the application does not permit using wildcards (*,?) at the start of a search term as this can result in performance issues. There should be a minimum of 3 preceding characters to perform Wildcard searches currently, or the following error is displayed: "There should be a minimum of 3 characters before wildcard in 'List of Terms' section". |
||
|
Complex Searches - Complex searches can be performed by combining search terms and operators such as wildcard characters, fuzzy elements, and alternating characters. |
|
|
|
Regular Expression Searches - Search for a sequence of symbols or characters expressing a string or a pattern (regular expressions) like Social Security Numbers, Credit Card numbers, phone numbers, dates, IP Addresses and so on. |
|
|
Where to Search
Enables the user the ability to search within the following zones of a communication:
Subject - Enable this option to search for words or phrases in the document Subject.
Body - Enable this option to search for words or phrases in the documents Body.
System - Enable this option to search for words or phrases in the System Generated messages within the document.
File/Attachment(s) - Enable this option to search for words or phrases in the file attachments within the document.
Action Event - Enable this option to search for words or phrases in the Action Events tab.
Policy Event - Enable this option to search for words or phrases in the Policy Events tab.
Audio Transcription - Enable this option to search for words in phrases in the transcribed audio content in Enterprise Conduct.
Important
Audio Transcription search zone is currently only within Enterprise Conduct admin, review, and archive searches.
Participants/Groups
Search for communication between the custodians of a case and specific Participants or Group(s) of Participants.
The
Include Unmapped Network Endpoint ID(s) for selected participants checkbox for Tier 1 participant searches allows the system to identify and report unmapped network endpoint IDs during the promotion process. These are participants who were not correctly mapped during the data ingestion. This option is specifically designed for Tier 1 and Both Tier 1 and Tier 2 participant searches.
The user can further filter the search results by selecting one of the following options:
Any of these - Selecting this option will display search results containing any of the selected Participants/Groups.
All of these - Selecting this option will display search results containing all the selected participants/Groups.
Selecting Internal Participants
Click the Find link next to Participants/Groups. The Select Participants screen appears.
Select the participant(s) and/or group(s) you are interested in and click Add.
You can also filter the Participants/Groups by clicking the Recipient Type button next to the Add button, and selecting from the following options:
Any - Selecting this option will filter the participants/groups who are part of any of the recipients lists such as From, To, CC, BCC, and Sender.
To - Selecting this option will filter the participants/groups who are part of the To recipients list only.
Cc - Selecting this option will filter the participants/groups who are part of the Cc recipients list only.
Bcc - Selecting this option will filter the participants/groups who are part of the Bcc recipients list only.
To/Cc/Bcc - Selecting this option will filter the participants who are part of the To, Cc, and Bcc recipients lists.
Click Close to exit the dialog.
Participant Search UI for ISSV2 API Enabled Users
The participant search UI is slightly different for ISSV2 API-enabled users. The following changes apply:
The Search button is enabled after the user enters at least five characters in the Search box.
The Search Results are automatically cleared when the user removes the search keyword from the Search box.
An additional Search By filter is available to search participants based on the following criteria, offering more granular search by each ID :
First name/Last name: Search for participants by their first or last name.
Email ID: Search for participants by their email address.
User ID: Search for participants by their unique user identifier.
Employee ID: Search for participants by their employee ID number.
Network Endpoint ID: Search for participants by the globally unique identifier of their network endpoint.
Participant Role Mapping
Enterprise Archive indexes participant roles by grouping them into their respective categories. The following table lists this mapping with respect to participant roles across IM, Collab, and Email data. Users can use the EA Mapped Role column below to search by the desired roles, and to map the count displayed beside the role. For example, in the sample screenshots below for a social network, clicking on the Others count will display the respective roles.
|
Participant Role (Email, IM, and Collab) |
EA Mapped Role |
|
Author |
From |
|
Caller |
|
|
Creator |
|
|
From |
|
|
Initiator |
|
|
Organizer |
|
|
Poster |
|
|
Presenter |
|
|
Responder |
|
|
Updater |
|
|
To |
To |
|
Assignee |
|
|
Callee |
|
|
Commenter |
|
|
Follower |
|
|
Miscellaneous |
|
|
None |
|
|
Optional Invitee |
|
|
Participant |
|
|
Rater |
|
|
Recipient |
|
|
Re-poster |
|
|
Required Invitee |
|
|
Subscriber |
|
|
Cc |
CC |
|
Bcc |
BCC Current Product Behavior Currently Journal emails that are ingested using Email Gateway will map the 'Recipient' participant role as 'BCC' when:
|
|
Moderator |
Others |
|
Owner |
|
|
Reviewer |
|
|
System |
System |
|
Sender |
Sender |
Searching by Sent on Behalf
To search for email conversations that are sent on behalf of the original sender:
Select the desired Participants from the Participants/Groups window.
Select the Recipient Type as Sender.
Participant(s) selected under Recipient type as Sender will return documents sent by selected participants on behalf of someone.
The From role represents the original sender of the email. The Sender recipient type had been introduced to represent delegated senders that send on behalf of the From participants.
Adding Internal, External, Public, or Federated Participants
Click the Add New link. The Add Participants/Groups text-box appears with two panes.
Enter the external or public participant's network display name or their Network Endpoint ID. One line per participant (the top pane) and/or the name of the group (the bottom pane)
Click Add. To add more public participants, enter their respective Network Display Names or Network Endpoint ID, and then click Add.
You can also filter the Participants/Groups by clicking the Recipient Type button next to the Add button, and selecting from the following options:
Any - Selecting this option will filter the participants/groups who are part of any of the recipients lists such as From, To, CC, and BCC.
Sender - Selecting this option will filter the participants/groups that represent delegated senders that send on behalf of From participants.
From - Selecting this option will filter the participants/groups who are part of the From recipients list only.
To - Selecting this option will filter the participants/groups who are part of the To recipients list only.
Cc - Selecting this option will filter the participants/groups who are part of the Cc recipients list only.
Bcc - Selecting this option will filter the participants/groups who are part of the Bcc recipients list only.
To/Cc/Bcc - Selecting this option will filter the participants who are part of the To, Cc, and Bcc recipients lists.
Once you have completed adding participants, click Close.
Click Search to search for communications between the custodians and the participants/groups selected using the above method.
Searching by Out of Office
To search for out of office related email conversations:
Specify X-Auto-Response-Suppress in the Must have all of these keywords under the List of Terms or in Advance Query field.
Enable the System check box in the Where to Search pane.
Number of Participant(s)
Search for communications based on the number of participants involved by applying any of the following conditions:
Number of Attachment(s)
Search for communications based on the number of attachments in the conversation and by applying any of the following conditions:
Attachment Name
Search for communications by specifying the attachments name. Multiple attachment names can be specified in separate lines.
Important
Wildcards cannot be used as a leading character while searching for attachments within documents. For example, *.pdf.
Attachment Extension
You can either type the desired format such as docx or ppt or choose the following formats from the Extensions drop-down:
txt
pdf
xml
Document Size incl. Attachments
Search for communications based on the conversation size (includes attachment size) and by applying any of the following conditions:
The size can be specified in Bytes, KB, or MB.
Attachment Size
Search for communications based on the attachment size only and by applying any of the following conditions:
The size can be specified in Bytes, KB, or MB.
Communication Channel
Communication Channel refers to the mode of communication within a network. For example, emails, collaboration, chat, voice, videos, blogs, and so on, which can be from one or more networks.
The Communication Channels filter allows you to s earch for communications archived from specific communication channels or modality of communication. By default, Enterprise Archive searches for communications from all the channels recorded. However, if you want to search for communications from specific channel(s), you can select specific check boxes next to the Channel name and initiate search. IM and Chat conversation are displayed as Contextual-Replies (In-line Threaded Conversations).
Network
Network refers to the source of archived communication. For example, MS Teams, Slack, Journal, Zoom, and so on.
The Network filter allows you to search for communications archived from a specific networks. By default, Enterprise Archive searches for communications from all the networks recorded. However, if you want to search for communications from specific network(s), you can select specific check boxes next to the Network name and initiate search.
Text Extraction Status
The Text Extraction Status search criteria allow you to search for documents having attachments with failed text extraction. It also provides parameters that help you filter or select the attachments that have failed text extractions in unique manners. For example, if you select the Unknown file type filter under the Text Extraction Status group box, then Enterprise Archive retrieves conversations having attachments for which the file type cannot be determined. Enterprise Archive allows you to view details of such files in the View Source tab in the conversation snapshot.
Select one of the following from the Text Extraction Status group box:
Cumulative Text Extraction Limit Exceeded - Retrieves conversations where the cumulative size of all attachments exceed 500 MB.
File encrypted - Retrieves conversations that have encrypted file attachments.
File too large - Retrieves conversations with at least one attachment of size greater than 2 GB.
No Issues - Retrieves conversations that had no issues in extracting texts in attachments.
Parse Error - Retrieves conversations that have issues other than the listed issues.
Text too large - Retrieves conversations with at least 1 attachment of size greater than 100 MB.
Time Limit Exceeded - Retrieves conversations that are not processed within a time limit.
Too many files - Retrieves conversations that have more than 1000 attachments.
Unknown file type - Retrieves conversations which have attachments for which the file type cannot be determined.
Refer the Enterprise Archive Conversation and File Size Limitations topic for more information on the various file size limitation in Enterprise Archive.
Attachment with text extraction failures are represented with a yellow exclamation mark. Hovering over the exclamation mark displays a tool tip with the type of text extraction error:
Example of Parse error in the UI:
Direction
Search for communications based on the existence of internal/external participants. The various direction types are explained below:
Internal Only - All supervised participants are internal only or there are no external participants.
External Only Outbound - There is a mixture of supervised users (internal) and external participants. The from participants are internal only and there is only one internal employee in the communication.
External Bidirectional - There is a mixture of supervised users (internal) and at least one external participant. The communication type has no identifiable initiator to determine a direction.
External Inbound - There is a mixture of supervised users (internal) and external participants. The from participants are external only.
External Mixed Outbound - There is a mixture of supervised users (internal) and external participants. The from participants are internal only and there are more than one internal employees in the communication.
External Only - All supervised participants are external only or there are no internal participants.
IDs
Search for communications based on system identifiers that have been assigned to them. Select the ID Type and enter the respective ID in the ID field:
The following are the ID Types:
|
ID Types |
Description |
|
GCID |
Unique identifier assigned to each communication. This value is used to help debug issues that occur in Enterprise Archive. |
|
Journal ID |
Unique identifier assigned to each journal communication. This value enables you to search for specific journal communication ingested from Email Gateway (EGW). |
|
Interaction ID |
Unique identifier assigned to an IM/chat conversation that identifies as an interaction between one or more participants. |
|
Transcript ID |
Displays the Transcript ID of the conversation as recorded in Vantage and Socialite. These Transcript IDs can be used as reference for tracing the conversation in Socialite or Vantage. |
|
Snapshot ID |
Unique identifier assigned to each snapshot stored in Enterprise Archive. |
|
Message ID |
Unique identifiers assigned to each email coming from Microsoft Exchange Server or Email Gateway. This means, all such communication will have Message ID and Journal ID as well. |
|
Key |
The S3 key used to uniquely identify and locate objects within Amazon S3 storage. Applicable only for Tier 2 search. |
|
Any |
To search across any ID Types. |
Holds
Search for communications that have been placed on legal hold previously, by selecting the checkbox as shown in the following image.
Tags
Tags are applied while collecting documents in the case management Collect workspace. From the case management Review workspace, communications can be further filtered based on the tags that have been applied or no tags at all as shown in the following image.
