Every search requires a name. By default all admins have permission to access all searches. Non-admin users need to be granted specific permission to work with the search results. Permissions can be specified to allow access to a search but to disallow the non-admins ability to export or change to scope of the search.
Date range, tags, Legal hold*, permissions and a
descriptive note are optional fields. Tags help you organize your system
when you have many saved searches and the descriptive note
will display in the list of all saved searches.
Date range is only optional if a search term, email address, search list, etc has been selected. Random search does not allow you to only set a sample size ("%") and perform the search.
*Legal hold - The legal hold option allows to choose whether to display 1) All results 2) Only results on legal hold 3) Exclude results on legal hold. Note that this optional field can be used as the sole search criteria/condition.
Random Search, in its current configuration, can only
randomize a data set of up to 5,000 messages. If a "red
banner" error message appears at the top of the page when you
create search, this means that you exceeded the 5,000 messages
limit. In this case, we encourage you to use search terms,
narrow down the sample size, or narrow down the date range to
get rid of the error message and proceed with the random
* It may take up to 10 minutes before being able to access the results. Time to access the results may vary according to the data set being randomized.
* There is a workaround to get significantly faster search results:
1. Perform a Simple search with the date range (or search criteria) that you want to perform the random search on.
2. Create and run a new random search, applying the same date range (or search criteria).
3. The results will be display faster given that the indexes have already been cached.
HOW SEARCH WORKS
In all searches, there's an "AND" relation between the search
terms and the start/end dates.
NOTE: If the terms or phrase you are searching for contains a ":" you need to include the search terms or phrase between quotation marks ("..."). For instance, if you are looking for the terms/phrase the broker did the following: then, you would have to write in the search terms field: "the broker did the following:".
Wildcard Query Operators
You can use wildcard
operators to locate messages and/or documents based on partial
terms. You can use the asterisk ( * ) operator to locate
messages and/or documents that contain specified partial
terms. For example:
contract* - Denotes any term that begins with “contract” (such as “contract”, “contracts”, or “contracted”).
*acme.com - Denotes any term that ends with “acme.com” (such as “email@example.com or firstname.lastname@example.org).
*43931* - Denotes any term that contains the sequence “43931” (such as “$43931.00” or 9543931226).
You can use the question mark (?) operator to locate messages that contain a specified term, with a given character replaced. For example:
“???? ???? ???? ????”- Denotes any term that contains four sets consisting of four characters each with a single space between sets (4417 1234 5678 9012, a common format for credit/debit card numbers”).
“???\-??\-????” - Denotes any term that contains a set of three characters, followed by a dash, followed by two characters, followed by a dash, followed by three characters (i.e. 123-45-6789, a common format for U.S. social security numbers). See the section below “Searching for Terms that Contain Reserved Characters” for the explanation of “/” use.
?inks - Denotes any term that contains any character proceeded by the string “inks” (such as “links” and “rinks”).
“well gra?e?” - Denotes any phrase beginning with the term “well” followed by a space and then a term that contains the string “gra”, followed by any character, followed by the letter ‘e’, followed by any character (such as “well graded” and “well grates”).
NOTE ON WILDCARDS (*): Wildcards can be used
with any kind of words or number as long as they contain at
characters or numbers. Using wildcards on words will less than
5 characters or strings with less than 5 numbers won't be
NOTE ON LEADING WILDCARDS (*): Leading
wildcard query operators can only be used with the following
fields: Sender, To/cc/bcc, Subject, Attachment Name and
Any Address Field. Leading wildcard query operators cannot be used
with the following fields: Body Text and Attachment Text.
A random search is designed for compliance users who wish to
provide with a randomly selected set of email messages without
any discrimination on content. A random search provides
predefined search fields that expand the Simple Search basic criteria,
and the ability to add or remove new search conditions. You
can use random searching when AND/OR conditions are required
on subject, To/cc/bcc, Sender, Body Text, Attachment Text or
Sample size: enter a percentage (%) as a whole number (example: 5 = 5%, 10 = 10%).
Include: Select E-mail, Lync IMs, or both for inclusion in the search (if Lync instant messages are enabled).
Add a Condition: Use the drop down box to define the
email component you would like to search.
1. The first drop down box lets you choose
between six email components:
* Body Text
* Attachment Text
* Attachment Name
* Any Address Field
2. The second drop down box allows you to define Does or Does not.
3. The third drop down allows you to define Contain or Contain items from a list. You might also choose Contain the phrase for the Body Text or Attachment Text fields.
4. The fill-in white box
after the 3 first dop-down boxes will allow you to either
enter keywords for your search (should you choose Contain) or to choose
from a search list that you
would have created before creating the search (should you
choose Contain items from a
Once you are
done populating the name, date range, sample size, and one
or more predefined search field(s), click on Save and display results to save your
search and access your search results; or click on Save and return to list to
save your search and return to the SAVED SEARCHES page with
all the previously created searches.
- Random search