About the search criteria options
|Article:HOWTO58624|||||Created: 2011-08-01|||||Updated: 2013-07-12|||||Article URL http://www.symantec.com/docs/HOWTO58624|
When you construct a search that contains multiple options, pay attention to how each option interacts with the others in the search properties pane. Discovery Accelerator links all the selected options together with Boolean AND operators rather than OR operators. For example, suppose that you construct a search whose criteria include the following:
A data range in the Date range section
A search term in the Search terms section
A file extension in the Attachments section
The search results contain only those items that match all the search criteria. Discovery Accelerator ignores any items that match some of the search criteria options but not others.
The search properties pane has the following sections:
The Search section identifies the search and specifies when it runs.
The Date range section lets you search for items according to when they were sent or received.
This feature is available only if you have the Select Archives in Search permission in the case.
The feature is not available when you define the criteria for a scheduled search; you can use it when you set up immediate searches only.
The Archives section lets you restrict the scope of a case-level search or folder-level search to certain archives only. By default, Discovery Accelerator searches all the archives in the vault stores that you have selected for the case. However, this may be undesirable and time-consuming if Discovery Accelerator must search many thousands of archives unnecessarily.
To select the archives in which to search
Click Search these archives.
Click the Archive Picker option at the right.
In the Select Archives dialog box, select the required archives.
You can select up to 5000 archives from the case-level archive list.
The Search terms section specifies the words or phrases for which Discovery Accelerator should search in items. Clickto add each word or phrase for which you want to search. Note the following:
Discovery Accelerator searches are case-insensitive.
To search for a phrase, enclose the words in quotation marks.
For example, you can search for all items whose subject lines contain the phrase "organizational changes" by defining a search term like this one:
SUBJ: "organizational changes"
Discovery Accelerator considers the file names of message attachments to be their subjects. So, the preceding search term finds both items that contain the phrase "organizational changes" in their subject lines and attachments that have this phrase in their file names.
If you type multiple words on the same line, Discovery Accelerator finds all items that contain any of the words or phrases on the line.
Note that you must separate all the words in the search term with spaces. The following search term does not return the expected results because there is no space between words the "changes" and "license" - and consequently Discovery Accelerator searches for items that contain one or more of the following words: "organizational", "changeslicense", and "agreements".
SUBJ: "organizational changes""license agreements"
Similarly, the search terms license;agreements and license; agreements differ because, in the second case, a space follows the semicolon. The presence of the space causes Discovery Accelerator to find the items that contain either word, whereas the absence of the space causes Discovery Accelerator to treat the search term as a phrase.
Press the Return key in a search box to add another line to it. If you type multiple lines in a search box, chooseor in the left box to determine whether OR or AND conditions connect the lines.
To add the name of a custodian or target to thebox or box, click at the right and then selected the required custodian or target.
To identify the custodians for whom you want to search, you specify their primary attribute values. By default, the primary attribute value of a custodian is his or her display name. However, Custodian Manager lets you nominate an alternative attribute as the primary attribute. For example, you can choose to search for custodians by their employee ID numbers.
If you specify as a custodian or target a Domino user whose details you synchronize with a Domino directory, you must ensure that this user has an SMTP address defined in the Domino directory. Otherwise, the search fails to find the matching items. Alternatively, you can search for such users by their display names.
Use the fields in the Custodian Manager options area to specify how to search for custodians or custodian groups. You can choose to search email addresses, display names, or both email addresses and display names. If you select , a custodian or custodian group must have either a matching email address or a matching display name to meet the search criteria; it does not need to have both.
Selectif you want Discovery Accelerator to search not only the display name and email address of a custodian group but also the email addresses of all the members of the group.
The conditions that you enter in the Custodian Manager options area use the custodian information that is available at the time that you build the search. This information is not updated unless you edit the search again. For example, when you create a search and select the option , the list members at that time are saved with the search. If the membership of the list changes later, these changes are not applied to the search until you edit and save it again.
Place the plus sign (+) in front of a word or phrase to connect it to every other word or phrase on the line with a Boolean AND condition. This sign instructs Discovery Accelerator to treat the specified word or phrase as required criteria. For example, the following search string means "(server AND test) OR (group AND test) OR (cluster AND test)":
[Any Of] server group +test cluster
In the following example, the search string means "(server AND test AND group) OR (cluster AND test AND group)"
[Any Of] server +group +test cluster
Place the minus sign (-) in front of a word or phrase to connect it to every other word or phrase on the line with a Boolean AND NOT condition. This sign instructs Discovery Accelerator to exclude from the result set those results that match the other search criteria and contain the excluded term. For example, the following search string means "(server AND NOT test) OR (group AND NOT test) OR (cluster AND NOT test)":
[Any Of] server group -test cluster
In the following example, the search string means "(server AND cluster AND (group AND NOT test))":
[All Of] server cluster group -test
A search term cannot comprise an excluded word or phrase only. When you specify such words or phrases, you must also specify a positive word or phrase that you want to appear in the search results.
You can use an asterisk (*) wildcard to represent zero or more characters in your search. Use a question mark (?) wildcard to represent any single character.
A wildcard search always finds items that match your search criteria and that were archived in Enterprise Vault 10.0 or later. To ensure that the search results also include older matching items that are in your archives, enter at least three other characters before the wildcard. For example, the following search string returns hits for the words "make", "maker", "making", "wonder", "wondering", and so on:
[Any Of] mak* Wonder*
You can include wildcard characters in the email addresses that you specify in abox or box. The following example finds items from users with an email address that includes "@acme.uk" or "@acme.hk":
[Any Of] @acme.?k
However, you cannot use either wildcard character after a special character, such as the ampersand (@). For example, the search string "@?cme.uk" does not produce the expected results.
Discovery Accelerator ignores any nonalphanumeric characters in the search term, except for those that have special significance, such as the plus sign, minus sign, and question mark.
For example, a search for the term US@100 may find instances not only of US@100 but also of US 100 and US$100. Including nonalphanumeric characters in the search term may therefore return more results than you expect.
The Attachments section lets you search for items with a certain number or type of attachments.
The Miscellaneous section lets you search for items of a certain size and type or that have the specified retention category.
The Policies section lets you search for items according to the tags with which any additional policy management software has classified them.
The Custom attributes section lets you search for the items that have the specified attributes. When Enterprise Vault processes an item, it populates a number of the item's properties with information and stores this information with the archived item. Some third-party software may also attach additional property information to items. If you know the name of a property that interests you, you can enter its details here as a custom attribute.
Do not enclose attribute values in quotation marks if you want to indicate that they are phrases. Instead, selectas the operator for these attributes, if you have a choice. Alternatively, you can indicate that an attribute value is a phrase by replacing all the spaces with periods, as follows:
This technique lets you specify multiple phrase values for the same custom attribute. For example, consider the following attribute value:
Enterprise.Vault.Service.Account system DA.Administrator
This value matches "Enterprise Vault Service Account", "system", and "DA Administrator".
Article URL http://www.symantec.com/docs/HOWTO58624