If you are concerned abou Indexes and inconsistancy, you can validate the Index against the DB entries using Indexcheck
Check this TN:
http://support.veritas.com/docs/280895

Thanks for the replies.

Firstly we are running EV 2007 V7.5 , am I right in thinking to rebuild its just a case of right clicking and choosing rebuild index volume ? I presume I can do this in a live environment ?

I have run the Indexcheck command 

indexcheck -c exist -f e:\index1 -ignorewarnings > e:\indexcheck.log

and got this at the end of it.

Finished. Checked 2477 index(es), 0 with errors, 0 with warnings
End time: 03/06/2009 14:56:29
Duration: 15 minute(s) 5 second(s)

To rebuild all for a particular archive; go to the properties of the archive, Advanced tab and click Rebuild.

The command for Indexcheck you used is to verify locations.  I would add the -c stats switch to compare the Index to the DB
the example in the doc:  IndexCheck.exe -c stats -f C:\Program Files\Enterprise Vault\Indexing\1773A46CFC34... -db SQLserver2 -diff 20

Paul

Keep in mind that an Index rebuild could take weeks to finish...!

Cheers
Michel

Oh, Paul.
You could use FederatedSearch:
http://seer.entsupport.symantec.com/docs/292820.htm

I know it states that it was added in 8.0 SP1, but I believe it works for previous version, too.
This should search more than one index volume, so that you will get a unified result set.

Cheers

Hi,

I don't see a problem with the indexes from a quick read of the above.  The data has been stored across several index volumes and so is showing you the each of these volume.  The dates I think are the dates on the emails rather than the archived date so that might explain the data overlap.  So if you look you will see emails with those dates.  EV hasn't got it wrong.  I don't think rebuilding will change the data.
Since it's a journal archive then it is already using federated search, that is why you are seeing results from more than one index volume. 
So I think some have rebuilt quickly because infact they are empty as all the items from them have been expired.

Like I say kind of an educated guess based upon a quick read.

So by default when you indexes are 5 or less indexvolumes then it will just do the search across those 5 for you.  If you have greater than 5 then it basically is trying to say hey this is just too much data to search, can you be a bit more specific and so it lists the particular index volumes for you to choose and then when you choose one it will then do the search for that particular index volume.

Paul

What is your use case for searching the Journal using "standard" EV Search?
Maybe, you could benefit from Discovery Accelerator?

Cheers

Hi,

So as Michael says you can set MaxVolSetsToSearch to a higher number but probably that's not ideal. 
Also I think you have chosen to rebuild based upon the indexvolume tab.  The thing with that is that you'll still end up with the same number of indexvolumes and so still too many to be easily searched.  If instead you choose rebuild on the 'advanced tab' that will effectively delete all your existing index volumes and start again from scratch so then it may just end up with 3 or so indexvolumes is enough to hold all your active data for example.

So assuming your old index volumes are empty I think there is a slight bug in that EV is listing index volumes that are actually empty.

Thanks again for all the replies.

The reason for the searching is mainly for disciplinary and FOI requests from outside of our organisation and are performed by a Data Protection Officer.

The DPO just gets a little confused when he's seeing dates back to 2007 within the search when he knows we only store email for 1 year, and also some dates he has to search on simply dont appear in the list.

Your right I was looking at the Index volume tab. I've now kicked of a complete rebuild but done it from the Advanced tab, we'll see how many weeks it takes !

Thanks again for all the help.

Weeks was right ! Still if it cleans everything up then its worth it.

Percentage completed: 0%
Estimated time of completion: 17/06/2009 16:24

Wow 2 weeks you are so lucky

I have to rebuild mine in the comming months but it will take me 6 months at least to get mine rebuilt

BTW. If one if the posts is your solution please mark it as such to keep only open issues unmarked

My reindex has finished ! Quicker than expected. All looks good now with the dates in that I have a complete range from up to a year ago. I just have one small niggle.

When I search my journal under the Archived dropdown list I have all the correct dates but they are not in date order, ie my first date range is

13 Oct 08 til 30th Oct 08, but then the next in the list is 02 December 08 - 17 December 08 . Is there anyway to get these to apperar in the correct order so I dont have to browse through the entire range to get the dates I'm looking for ? Or even better get rid of the drop down and just have it automatically span the entire index ?

Thanks

Paul

Nope afraid not I recall this being mentioned various times but obviously this has not been rectified or I do not recall seeing anything statung that this has been done.
To get it to not give you the drop down you just need to set FederatedSearchMaxVolSets in webapp.ini to a larger value than the number of index volume sets you have. (Default is 5)

Paul

Could you mark this thread as solved if you're satisfied with this answer?

Cheers