Creating and running Discovery Accelerator searches

Article:HOWTO58665  |  Created: 2011-08-01  |  Updated: 2013-02-01  |  Article URL http://www.symantec.com/docs/HOWTO58665
Article Type
How To


Subject


Creating and running Discovery Accelerator searches

You must have the Search permission in a case or folder to create and run a search in it. If you have the Search Preview permission, you can preview the results of a search before you accept them.

To create and run a Discovery Accelerator search

  1. Do one of the following:

    • To create a search that runs in a case, click the Case tab in the Discovery Accelerator client and then click the required case in the left pane.

    • To create a search that runs in a research folder, click the Research tab in the Discovery Accelerator client and then click the required folder in the left pane.

    If Discovery Accelerator lists a lot of cases and folders, you can filter the list with the fields at the top of the pane.

  2. Click the Searches tab.

  3. Click New Search.

    The search properties pane appears.

    Search properties pane
  4. If you are creating a search that runs in a research folder, and you clicked All Research in the left pane, Discovery Accelerator prompts you to select a case with which to associate the search. Make your selection, and then click Search.

  5. Enter the required search criteria.

    See About the search criteria options

  6. Click Save to start an immediate search or queue a scheduled search to start automatically at the appointed time.

    Discovery Accelerator displays a preview list as soon as it finds a search result. You can immediately begin to read items from the preview display, and, if necessary, stop a search that does not return the results that you expect. Then you can refine the search criteria and perform the search again.

    The Search Details pane provides the following information:

    Archive

    Shows the name of the archive that Discovery Accelerator has searched.

    Volume

    Provides the ID of the volume that holds the archive.

    Vault Store

    Indicates the type of vault store that contains the archive.

    Status

    Shows the current status of the search in each archive.

    Duration

    Shows the amount of time that Discovery Accelerator has taken to search each archive.

    Hits

    Shows the number of items in each archive that match the search criteria.

    Information

    Provides details of any errors that occurred.

    You can filter the list of archives by selecting an option in the Show list. For example, you can filter the archives to show the top 2000 archives by hits, or all archives with a status of "Error". To download the search details as a comma-separated value (CSV) file, click Download Search Details for All Archives.

  7. When the search has completed, choose whether to accept or reject the results. Note the following:

    • Discovery Accelerator does not add the captured items to the review set until you accept the search results. If you did not check Automatically accept search results, you must manually accept or reject the results.

    • The options to assign a default mark and reviewer to the search results apply only to newly discovered items. If the search results include items that you have previously captured and added to the review set, these items retain their assigned marks and reviewers.

      The option to keep existing marks applies only to those items to which reviewers have already assigned marks in another case.

    • If you reject the results of a search, Discovery Accelerator deletes the search and results from the database. However, it leaves the actual items in the archives.

    • It is important that search results make sense because, after you accept the search, you cannot undo it.

See Pausing and resuming Discovery Accelerator searches

See About the Discovery Accelerator permissions

See How retained marks work

See Selecting the archives in which to search

See Building Discovery Accelerator search schedules

See Defining email targets with Address Manager


Legacy ID



v14264998_v41328188


Article URL http://www.symantec.com/docs/HOWTO58665


Terms of use for this information are found in Legal Notices