Conduct Admin Search
Select from the topics below to understand what is Conduct Admin search in Enterprise Archive.
What is Conduct Admin Search?
Conduct Admin Search feature is available only to Queue Administrators that have been assigned to a Conduct Queue while creating queues. Admin Search provides Queue Administrators access to all the communications present in their assigned queues. This feature enables Enterprise Archive users to always have access to data in the system, including situations when the reviewers are not available. The following key operations can be performed from the Conduct Admin search interface:
Search for a particular conversation or a group of conversations.
Export conversation/conversation metadata content
Release an assigned conversation.
Assign a conversation to a reviewer.
Update a conversation.
Close a conversation.
Re-Open a closed conversation.
How to access Conduct Admin search?
Conduct Admin search is accessible only to Conduct Queue Administrators and can be accessed without having to select a review queue.
To access Conduct Admin search, from the Conduct tab, click the Admin Search menu option.
What are my searches based on?
Conduct Admin search can be based on a conversation's:
Archived Time: The date/time when the conversation was archived in Enterprise Archive.
Sent Time: The actual send date/time specified in the interaction.
Queued Time: The actual date/time when the document was added to the queue. This is the default Type selected in Review Search .
Last Updated Time: The actual date/time when the most recent action was performed on the interaction.
What are the types of searches that can be performed?
The following types of searches can be performed from Conduct Admin search:
Date Range
The Date Range filter present at the top of the Admin search pane has the following default settings that auto-populate when searching in Enterprise Archive.
Timezone - GMT/User Preference
Type - Queued Time
Range - Last 7 Days
The filters are explained in detail below.
Searching by Date allows the user to search for the following Types of interactions:
Queued Time: The actual date/time when the document was added to the queue. This is the default Type selected in Admin Search and Review Search .
Last Updated Time: The actual date/time when the most recent action was performed on the interaction.
Archived Time: The date/time when the interaction was archived in Enterprise Archive.
Sent Time:The actual send date/time specified in the interaction. This is the default Type selected in Archive Search.
The available date range filters are given below. Selecting any of the options below include until midnight of the previous day.
Last 7 Days - Seven full previous days + Today till now
Last 30 Days - Thirty full previous days + Today till now
Last 90 Days - Ninety full previous days + Today till now
Between: When this option is selected, the Start and End dates are by default pre-populated with date and time equivalent to the 'Last 7 days' date range. Users can change the Start and/or End date as required up to a maximum range of 180 days. Start or End dates cannott be left blank, have invalid or inapplicable dates.
Words/Phrases
The Words/Phrases panel allows the user to perform simple keyword searches using the List of terms option, and advanced query searches using the Advanced Query option. The various searches that are supported for each search type are listed below.
Indexing Special Characters - Applies to List of Terms and Advance Query Search Types
The application search and indexing behavior is explained below and consists of the following components:
Enterprise Archive Index Store: Enterprise Archive indexes all the entries that a user can input. These entries are classified as keyword or text. Keyword entries are user inputs that should be searched as is, without analyzing them. Analyzing is the process of stripping (or transforming) user entries by tokenizing them, converting to lowercase, ASCII folded and so on. Text type fields are analyzed and any of the above actions are performed on them. Text fields refer to user content such as subject, body, and attachment text. All other user entries are keywords.
Querying the Enterprise Archive Index Store: Querying refers to searching for specific terms or phrases that are indexed. Anything that is not indexed cannot be searched in Enterprise Archive. Querying for special characters will not return any search results as the application analyzes text inputs and strips them of special characters.
List of terms
Select List of terms to perform simple keyword searches using the available filters as explained below:
The list of terms UI options are:
Must have all of these keywords: Using this search box returns search results containing all the specified keywords.
Must have at least one of these keywords: Using this search box will return search results containing any of the specified keywords.
Must not have any of these keywords: Using this search box will return search results not containing any of the specified keywords.
All the above search boxes contain an AND operator in between them.
To search for multiple words, enter the words in separate lines. A group of words in the same line will be treated as a phrase.
Reserved Words
The following words are reserved for application use, and will not be considered for their actual meaning when specified in uppercase format:
FOLLOWEDBY
NEAR
PRECEEDEDBY
NOTFOLLOWEDBY
NOTNEAR
NOTPRECEEDEDBY
EXCLUDING
List of Terms Search Behavior
The following rules are observed by the application while performing searches from the List of Terms field:
All extra white space is removed. For example: The sentence "insider trading details" will be analyzed as "insider trading details".
The list of stop words to be escaped can be custom defined by the customer.
Important
Enterprise Archive supports a maximum of 100 terms while using List of Terms search. A warning message will be displayed on using more than 100 entries.
Using Single/Double Quotes in Searches
Enterprise Archive search behavior with respect to the usage of single/double quotes is as follows:
A group of words in a single line with/without single/double quotes will be treated as a phrase.
A single sentence with/without quotes split into two separate lines will be treated two separate phrases.
Single/double quotes nested within a line will be ignored, and the entire line will be treated as a phrase.
The supported search types are as follows:
|
Search Type |
Syntax or Rules |
Example |
|
Simple Keyword Searches - Searches using specific terms in any of the List of terms filters are referred to as simple keyword searches. |
|
|
|
Phrase Searches - Searches using a specific groups of words in any of the List of terms filters are referred to as phrase searches. |
|
|
|
Proximity Searches - Searches for keywords or phrases occurring within a certain distance of each other can be performed along with the following proximity conditions:
|
The syntax for the proximity conditions are explained below:
where N is a numerical value, * allows wildcard searches for the attached word, | allows using more than one search term, ~ allows fuzzy searches for the attached word. |
|
|
Wildcard Searches - Search for multiple variations of a keyword using wildcard symbols. |
|
|
|
Important The application does not permit using wildcards (*,?) at the start of a search term as this can result in performance issues. There should be a minimum of 3 preceding characters to perform Wildcard searches currently, or the following error is displayed: "There should be a minimum of 3 characters before wildcard in 'List of Terms' section". |
||
|
Complex Searches - Complex searches can be performed by combining search terms and operators such as wildcard characters, fuzzy elements, and alternating characters. |
|
|
|
Regular Expression Searches - Search for a sequence of symbols or characters expressing a string or a pattern (regular expressions) like Social Security Numbers, Credit Card numbers, phone numbers, dates, IP Addresses and so on. |
|
|
Advanced Query
Smarsh recommends you to use the filters available on the search UI and List of Terms in particular to perform keyword based searches.
Advanced search must be used only when the above does not fulfill the user's requirement. Users must be familiar with Lucene syntax to form accurate, and specific queries to avoid inconsistent results.
Enterprise Archive supports a maximum of 1023 terms while using Advanced Query search. A warning message will be displayed on using more than 1023 terms.
Select Advanced Query to perform advanced searches using Boolean operators.
The types of Advanced searches that can be performed are explained in the table below:
|
Search Type |
Syntax and Rules |
Example |
|
Boolean Searches - Boolean operators allow terms to be combined through logical operators and grouping or phrase concatenation. Boolean search operators allow you to create advance search queries to include or exclude specific words. Boolean search provides the following search operators:
The OR operator is the default conjunction operator. This means that if there is no Boolean operator between two terms, the OR operator is used. |
|
|
|
Phrase Searches - Searches using specific phrases by enclosing the terms within double quotes. Multiple phrases can be combined using the above-mentioned Boolean operators. Without quotes, the search will treat each word as an individual search item. |
|
|
|
Proximity Searches - Search for specific terms or phrases occurring within a certain distance of terms or a phrase by mentioning a proximity value and using the '~' symbol. |
|
|
|
Wildcard Searches - Search for multiple variations of a keyword using wildcard symbols. |
|
|
|
Important Currently, the application does not permit using wildcards (*,?) at the start of a search term as this can result in performance issues. There should be a minimum of 3 preceding characters to perform Wildcard searches currently, or the following error is displayed: "There should be a minimum of 3 characters before wildcard in 'List of Terms' section". |
||
|
Complex Searches - Complex searches can be performed by combining search terms and operators such as wildcard characters, fuzzy elements, and alternating characters. |
|
|
|
Regular Expression Searches - Search for a sequence of symbols or characters expressing a string or a pattern (regular expressions) like Social Security Numbers, Credit Card numbers, phone numbers, dates, IP Addresses and so on. |
|
|
Where to Search
Enables the user the ability to search within the following zones of a communication:
Subject - Enable this option to search for words or phrases in the document Subject.
Body - Enable this option to search for words or phrases in the documents Body.
System - Enable this option to search for words or phrases in the System Generated messages within the document.
File/Attachment(s) - Enable this option to search for words or phrases in the file attachments within the document.
Action Event - Enable this option to search for words or phrases in the Action Events tab.
Policy Event - Enable this option to search for words or phrases in the Policy Events tab.
Participants/Groups
Search for communication between the custodians of a case and specific Participants or Group(s) of Participants. The user can further filter the search results by selecting one of the following options:
Any of these - Selecting this option will display search results containing any of the selected Participants/Groups.
All of these - Selecting this option will display search results containing all the selected participants/Groups.
Selecting Internal Participants
Click the Find link next to Participants/Groups. The Select Participants screen appears.
Select the participant(s) and/or group(s) you are interested in and click Add.
You can also filter the Participants/Groups by clicking the Recipient Type button next to the Add button, and selecting from the following options:
Any - Selecting this option will filter the participants/groups who are part of any of the recipients lists such as From, To, CC, BCC, and Sender.
To - Selecting this option will filter the participants/groups who are part of the To recipients list only.
Cc - Selecting this option will filter the participants/groups who are part of the Cc recipients list only.
Bcc - Selecting this option will filter the participants/groups who are part of the Bcc recipients list only.
To/Cc/Bcc - Selecting this option will filter the participants who are part of the To, Cc, and Bcc recipients lists.
Click Close to exit the dialog.
Participant Search UI for ISSV2 API Enabled Users
The participant search UI is slightly different for ISSV2 API-enabled users. The following changes apply:
The Search button is enabled after the user enters at least five characters in the Search box.
The Search Results are automatically cleared when the user removes the search keyword from the Search box.
An additional Search By filter is available to search participants based on the following criteria, offering more granular search by each ID :
First name/Last name: Search for participants by their first or last name.
Email ID: Search for participants by their email address.
User ID: Search for participants by their unique user identifier.
Employee ID: Search for participants by their employee ID number.
Network Endpoint ID: Search for participants by the globally unique identifier of their network endpoint.
Participant Role Mapping
Enterprise Archive indexes participant roles by grouping them into their respective categories. The following table lists this mapping with respect to participant roles across IM, Collab, and Email data. Users can use the EA Mapped Role column below to search by the desired roles, and to map the count displayed beside the role. For example, in the sample screenshots below for a social network, clicking on the Others count will display the respective roles.
|
Participant Role (Email, IM, and Collab) |
EA Mapped Role |
|
Author |
From |
|
Caller |
|
|
Creator |
|
|
From |
|
|
Initiator |
|
|
Organizer |
|
|
Poster |
|
|
Presenter |
|
|
Responder |
|
|
Updater |
|
|
To |
To |
|
Assignee |
|
|
Callee |
|
|
Commenter |
|
|
Follower |
|
|
Miscellaneous |
|
|
None |
|
|
Optional Invitee |
|
|
Participant |
|
|
Rater |
|
|
Recipient |
|
|
Re-poster |
|
|
Required Invitee |
|
|
Subscriber |
|
|
Cc |
CC |
|
Bcc |
BCC Current Product Behavior Currently Journal emails that are ingested using Email Gateway will map the 'Recipient' participant role as 'BCC' when:
|
|
Moderator |
Others |
|
Owner |
|
|
Reviewer |
|
|
System |
System |
|
Sender |
Sender |
Searching by Sent on Behalf
To search for email conversations that are sent on behalf of the original sender:
Select the desired Participants from the Participants/Groups window.
Select the Recipient Type as Sender.
Participant(s) selected under Recipient type as Sender will return documents sent by selected participants on behalf of someone.
The From role represents the original sender of the email. The Sender recipient type had been introduced to represent delegated senders that send on behalf of the From participants.
Adding Internal, External, Public, or Federated Participants
Click the Add New link. The Add Participants/Groups text-box appears with two panes.
Enter the external or public participant's network display name or their Network Endpoint ID. One line per participant (the top pane) and/or the name of the group (the bottom pane)
Click Add. To add more public participants, enter their respective Network Display Names or Network Endpoint ID, and then click Add.
You can also filter the Participants/Groups by clicking the Recipient Type button next to the Add button, and selecting from the following options:
Any - Selecting this option will filter the participants/groups who are part of any of the recipients lists such as From, To, CC, and BCC.
Sender - Selecting this option will filter the participants/groups that represent delegated senders that send on behalf of From participants.
From - Selecting this option will filter the participants/groups who are part of the From recipients list only.
To - Selecting this option will filter the participants/groups who are part of the To recipients list only.
Cc - Selecting this option will filter the participants/groups who are part of the Cc recipients list only.
Bcc - Selecting this option will filter the participants/groups who are part of the Bcc recipients list only.
To/Cc/Bcc - Selecting this option will filter the participants who are part of the To, Cc, and Bcc recipients lists.
Once you have completed adding participants, click Close.
Click Search to search for communications between the custodians and the participants/groups selected using the above method.
Searching by Out of Office
To search for out of office related email conversations:
Specify X-Auto-Response-Suppress in the Must have all of these keywords under the List of Terms or in Advance Query field.
Enable the System check box in the Where to Search pane.
Number of Participant(s)
Search for communications based on the number of participants involved by applying any of the following conditions:
Number of Attachment(s)
Search for communications based on the number of attachments in the conversation and by applying any of the following conditions:
Attachment Name
Search for communications by specifying the attachments name. Multiple attachment names can be specified in separate lines.
Important
Wildcards cannot be used as a leading character while searching for attachments within documents. For example, *.pdf.
Attachment Extension
You can either type the desired format such as docx or ppt or choose the following formats from the Extensions drop-down:
txt
pdf
xml
Document Size incl. Attachments
Search for communications based on the conversation size (includes attachment size) and by applying any of the following conditions:
The size can be specified in Bytes, KB, or MB.
Attachment Size
Search for communications based on the attachment size only and by applying any of the following conditions:
The size can be specified in Bytes, KB, or MB.
Communication Channel
Communication Channel refers to the mode of communication within a network. For example, emails, collaboration, chat, voice, videos, blogs, and so on, which can be from one or more networks.
The Communication Channels filter allows you to s earch for communications archived from specific communication channels or modality of communication. By default, Enterprise Archive searches for communications from all the channels recorded. However, if you want to search for communications from specific channel(s), you can select specific check boxes next to the Channel name and initiate search. IM and Chat conversation are displayed as Contextual-Replies (In-line Threaded Conversations).
Network
Network refers to the source of archived communication. For example, MS Teams, Slack, Journal, Zoom, and so on.
The Network filter allows you to search for communications archived from a specific networks. By default, Enterprise Archive searches for communications from all the networks recorded. However, if you want to search for communications from specific network(s), you can select specific check boxes next to the Network name and initiate search.
Text Extraction Status
The Text Extraction Status search criteria allow you to search for documents having attachments with failed text extraction. It also provides parameters that help you filter or select the attachments that have failed text extractions in unique manners. For example, if you select the Unknown file type filter under the Text Extraction Status group box, then Enterprise Archive retrieves conversations having attachments for which the file type cannot be determined. Enterprise Archive allows you to view details of such files in the View Source tab in the conversation snapshot.
Select one of the following from the Text Extraction Status group box:
Cumulative Text Extraction Limit Exceeded - Retrieves conversations where the cumulative size of all attachments exceed 500 MB.
File encrypted - Retrieves conversations that have encrypted file attachments.
File too large - Retrieves conversations with at least one attachment of size greater than 2 GB.
No Issues - Retrieves conversations that had no issues in extracting texts in attachments.
Parse Error - Retrieves conversations that have issues other than the listed issues.
Text too large - Retrieves conversations with at least 1 attachment of size greater than 100 MB.
Time Limit Exceeded - Retrieves conversations that are not processed within a time limit.
Too many files - Retrieves conversations that have more than 1000 attachments.
Unknown file type - Retrieves conversations which have attachments for which the file type cannot be determined.
Refer the Enterprise Archive Conversation and File Size Limitations topic for more information on the various file size limitation in Enterprise Archive.
Attachment with text extraction failures are represented with a yellow exclamation mark. Hovering over the exclamation mark displays a tool tip with the type of text extraction error:
Example of Parse error in the UI:
Direction
Search for communications based on the existence of internal/external participants. The various direction types are explained below:
Internal Only - All supervised participants are internal only or there are no external participants.
External Only Outbound - There is a mixture of supervised users (internal) and external participants. The from participants are internal only and there is only one internal employee in the communication.
External Bidirectional - There is a mixture of supervised users (internal) and at least one external participant. The communication type has no identifiable initiator to determine a direction.
External Inbound - There is a mixture of supervised users (internal) and external participants. The from participants are external only.
External Mixed Outbound - There is a mixture of supervised users (internal) and external participants. The from participants are internal only and there are more than one internal employees in the communication.
External Only - All supervised participants are external only or there are no internal participants.
IDs
Search for communications based on system identifiers that have been assigned to them. Select the ID Type and enter the respective ID in the ID field:
The following are the ID Types:
|
ID Types |
Description |
|
GCID |
Unique identifier assigned to each communication. This value is used to help debug issues that occur in Enterprise Archive. |
|
Journal ID |
Unique identifier assigned to each journal communication. This value enables you to search for specific journal communication ingested from Email Gateway (EGW). |
|
Interaction ID |
Unique identifier assigned to an IM/chat conversation that identifies as an interaction between one or more participants. |
|
Transcript ID |
Displays the Transcript ID of the conversation as recorded in Vantage and Socialite. These Transcript IDs can be used as reference for tracing the conversation in Socialite or Vantage. |
|
Snapshot ID |
Unique identifier assigned to each snapshot stored in Enterprise Archive. |
|
Message ID |
Unique identifiers assigned to each email coming from Microsoft Exchange Server or Email Gateway. This means, all such communication will have Message ID and Journal ID as well. |
|
Any |
To search across any ID Types. |
Policy Count
Search for communications based on the matched policy count and by applying any of the following conditions:
Source
A communication source is decided by the various methods that communications in the archive enter a specific queue. A queue administrator can choose to filter communications based on the following methods:
Policy: Filter communications that have entered a queue due to policy hits.
Random: Filter communication that have entered a queue due to random sampling criteria.
User: Filter communications that have entered a queue belonging to supervised users.
States
A communication's state is decided by the current state of a communication in a queue. A queue administrator can choose to filter communications based on the following states:
New: Filter communications that have entered a queue, and no actions have been taken on them.
Open: Filter communications that have been released into a queue, after assignment.
Escalated: Filter only communications that have been escalated by reviewers.
Assigned: Filter only communications that have been assigned to higher level reviewers.
Closed: Filter only communications that have been closed by reviewers.
Last Performed Actions
Filter communications on the most recent Conduct actions that have been performed by reviewers in a queue. A queue administrator can choose to filter communications based on the following actions:
Claim: Filter only communications that have been claimed by reviewers in a queue.
Release: Filter only communications that have been released into a queue by reviewers.
Update: Filter only communications that have been updated for comments by reviewers.
Assign: Filter only communications that have been assigned to other reviewers.
Escalate: Filter only communication that have been escalated to higher level reviewers.
Close: Filter only communications that have been closed by reviewers.
Queues
Search for communications based on the respective queues that you have been assigned administrator privileges by selecting the check box against the queue name.
Policies
Search for communications based on the policies that have been assigned to the queues for which you have been assigned administrator privileges, by selecting the check box against the policy name.
User
Search for communications based on the users who have performed actions such as Claim, Release, Update, Assign, Escalate, and Close by selecting the check box against the reviewer name.
Assigned To
Search for communications based on the assigned reviewers by selecting the check box next to the reviewer name. For example, if 'x' number of documents have been to assigned to 'John Smith', selecting 'John Smith' will display these 'x' documents.
Action Tags
Search for communications based on the available Action Tags by selecting from a list of Action Tags. Action tags will list tags that are used with the Escalate and Close actions while performing Conduct reviews.
Review Tags
Search for communications based on the available Review Tags by selecting from a list of Reviewer Tags. Reviewer tags will list tags that are used with the Update action while performing Conduct reviews.
Comment Search
Search for communications based on comments given by queue Reviewers and Administrators while performing any of the review actions. Enter comment details in the Comment Search window as shown below:
The Comment Search window currently has a character limit of 500 characters.
Policy of Interest
Select the desired policies to filter communications that have been tagged by these policies, when performing a review action.
To know more about Policy of Interest, refer the Policy of Interest topic.