Using Analytics search "ALLOF" "NOT ALLOF" "CONTAINS" "NOT CONTAINS" "ANYOF" "NOT ANYOF" results inconsistent.

Article:TECH208270  |  Created: 2013-07-05  |  Updated: 2013-07-08  |  Article URL http://www.symantec.com/docs/TECH208270
Article Type
Technical Solution

Product(s)

Issue



Using Analytics searching for "ALLOF", "NOT ALLOF" "CONTAINS", "NOT CONTAINS", "ANYOF" and "NOT ANYOF" returns unexpected results.

 


Cause



In a Discovery Accelerator advanced search within a Case's Review Set, messages with an attachment in which either the message or the attachment has one or more exclusion terms will be returned as either part of the total item does not have the exclusion term. This is due to Analytics being designed to use within-attachment searching instead of cross-attachment searching.

When Analytics processes items with attachments, the attachments and messages are placed into separate rows in the Analytics tables.  As an advanced search to exclude words is conducted, all rows with the exclusion words are noted and all remaining rows that match the remaining search criteria are returned in the search results.  If either a message or attachment row exists for a message with an exclusion word but the other part does not contain the exclusion word, the message and its attachment will be returned as meeting the criteria.  This is because one part of whole the message does not contain the exclusion word, thereby matching the remaining criteria.

For example:

  1. Message A contains an attachment.  The body of Message A contains the word 'litigation'. The attachment to Message A does not contain the word 'litigation'.
  2. Message B contains an attachment.  The body of Message B does not contain the word 'litigation'.  The attachment to Message B does contain the word 'litigation'.
  3. Message C contains no attachment.  The body of Message C contains the word 'litigation'.
  4. Message D contains no attachment.  The body of Message D does not contain the word 'litigation'.
  5. Message E contains an attachment.  The body of Message E does not contain the word 'litigation'.  The attachment to Message E does not contain the word 'litigation'.
  6. An advanced search looking for all items that do not contain the word 'litigation' is run.
  7. The advanced search returns:
  8. Message A because its attachment does not contain the word 'litigation'.
  9. Message B because its body does not contain the word 'litigation'.
  10. Message D because its body does not contain the word 'litigation'.
  11. Message E because neither its body nor its attachment contain the word 'litigation'.
  12. Only Message C is not returned as it has no attachment and its body does contain the word 'litigation'.

 


Solution



Product is working by design.  If any part of a message matches the non-exclusion search criteria, the message will be returned for review so the non-exclusion portion can be considered for possible inclusion into the final review set.

 


Supplemental Materials

SourceETrack
Value2968066
Description

Searching for "ALLOF", "NOT ALLOF" "CONTAINS", "NOT CONTAINS", "ANYOF" and "NOT ANYOF" returns unexpected results.



Article URL http://www.symantec.com/docs/TECH208270


Terms of use for this information are found in Legal Notices