Difference between revisions of "Retain Search"

From GWAVA Technologies Training
Jump to: navigation, search
(Main Search)
(Performing Searches)
Line 1: Line 1:
 
=Performing Searches=
 
One of the most important features of Retain is the ability to search for messages that have been archived and stored within the system. Within this module,  we will go over the way to be able to perform searches within the interface. Since Retain 4.0 will have a completely new searching mechanism, we've decided to keep this information in the training wiki until 4.0 is widely adopted.  This page provides better information than the current 3.x manual does.
 
 
===Searching as a User===
 
The administrator will have full access to all mailboxes and be able to search across the entire post office or domain. However, users by default, have restricted access just to themselves to be able to search or browse for messages. They also will have the ability to forward messages, and print messages; however, exporting, restoring, or searching in other  mailboxes outside their own cannot be done. The administrator can give users access to export, search on others mailboxes, and so forth according to what is needed. This can be done by going to the "Users or Groups" menu in the admin UI and adjusting the settings.
 
 
===Basic Questions for Searching Messages===
 
How do you search for messages within Retain?
 
What specific categories are there to be able to search messages?
 
What is the difference between searching as an admin in comparison of searching as a regular user?
 
 
===General Searching Explanation===
 
When a message is archived into Retain, the message goes through a process called indexing. Retain’s main indexer is Lucene, a powerful engine that indexes message content, message metadata, and message attachments so that they can later be searched for and found.  If a message does ''not'' get indexed, then the message cannot be found performing a search.  This does not mean the message has not been archived.  In fact, the message can still be viewed in the Browse section of the Retain mailbox. See, [http://support.gwava.com/kb/?View=entry&EntryID=2425 "Where Data Is Stored in Retain"].
 
 
There are multiple methods in performing a search. The first method is what is called the Quick Find.
 
 
===Quick Find===
 
 
[[file:1._Quick_Find.png]]
 
 
The Quick Find is not actually found in the Search tab within the Retain interface. Instead it is found in the Browse section for a user but - unlike everything else on the Browse tab - the Quick Find uses the indexes just like a search does.  This search is limited and can only be done on an individual mailbox. The Quick Find allows a way for a user to perform a search based on subject, content with a message or attachment, sender, recipient, etc.  Simply input text in the field and press Enter or click the magnifying glass to search.
 
 
===Main Search===
 
Within the Search interface, an administrator - or user - can enter in a term that will return results. Remember that indexing is important for accurate results when searching. In the Search tab, it will display the type of e-mail, the subject of the e-mail, who the message was from, and the date, which happens to be the delivered date generated by the e-mail system (not Retain).  There are multiple things that can be done with the messages that have returned results such as forwarding, litigation hold, exporting etc., but those features are not covered in this section.
 
 
One tip in viewing search messages is to make sure the view is set to a date range to display the messages correctly. See [[Retain Search#Viewing_Results|Viewing Results]].
 
 
<br>
 
<b>So how do you perform a search? </b>
 
 
::* Select the term on which you wish to search for (subject, sender(email), sender(display), etc.).
 
::* Select how you are going to search for it ("contains (exact"), "contains(fuzzy)", etc.). 
 
::* Enter the keywords you'll search on.
 
::* Select whether to serach all mailboxes or a selected one.
 
::* Adjust the scope: the item type, item source, and attachment size. 
 
::* Sort the search results if desired (defaults to creation date).
 
::* Indicate any tags you want to include.
 
::* Filter search results by any miscellaneous criteria (appointment/task start and end/complete date, item status, litigation hold status, and confidential status).
 
 
Then click [[File:1.1_Search_Button.PNG]]
 
<br>
 
 
We'll go over each of these sections in more detail starting with "Core".
 
 
===Core===
 
 
====Basic Search====
 
The  core section of searching are the terms for which you are searching and the mailbox on which you'll perform this search.  By default, the basic search is displayed. The difference between basic and advanced searches is that basic does not include search parameters - it acts primarily as a Quick Find. Type in the subject, text, sender, etc. in the field and that is it. The advanced search will allow you to search specifically within an area of the message or attachment. For example, entering in a search term for a subject that contains exactly what you are entering in will only display messages that contain that specific term in the subject field. If using a basic search, it could look in other areas as well and it not limited to - like in this example - the subject field.
 
 
====Advanced Search====
 
You can use up to 6 search terms when running an advanced search. Clicking on the expand button (the plus "+" sign) allows you to search for more than one entry at a time. This can help to increase exact specificity with what you are a looking for. When having more than one search term, '''it searches using the "AND" boolean expression'''; thus, the message ''must'' contain the terms you indicate exactly or nothing will be found. For example, if you search for a subject with "contains(exact)" and the term is "GWAVA", it will pull any and all results with the subject of GWAVA. If you add another search term, "RETAIN" for instance, then the subject ''must'' contain GWAVA '''''and''''' RETAIN. If an item only contains one of those search terms but not the other, it will not be included in the search results. '''Each additional "AND" search will be more specific and limited to the terms you are searching for.'''
 
 
[[File:3._Core.PNG||||border]]
 
 
 
====Tokenized Search Phrase====
 
The lucene indexing engine follows Unicode Standard Annex #29. This standard uses many common characters such as ' " . : @ + - * / and , as phrase ending or beginning characters. These characters will cause the system to read any character separated terms as individually entered items when the search is performed. Individually entered terms are treated as OR searches. For example, this means that using the search term 10/20 will be processed as 10 OR 20. Substituting a space instead of the character will provide a logical 'AND' search. For example, searching for 10 20 will be processed as 10 AND 20 as the search term.
 
 
In regular expressions, if you need to use a special character (like ^ \ / * . etc) in a regular expression, these characters have a special meaning, but if you need to search for them literally, you have to "escape" them by prefixing them with a backslash.
 
 
::'''Question:''' If you need to search for jdoe@xyzcompany.com, Lucene would interpret that as jdoe OR xyzcompany OR com. But could I do jdoe\@xyzcompany\.gov and would Lucene interpret that as a proper e-mail address?
 
 
::'''Answer:'''  No, there is no mechanism currently in Retain for escaping characters.
 
 
====Boolean Search Using "OR"====
 
Often users will want to do an "OR" search. If the message contains a subject of GWAVA ''or'' contains the subject RETAIN, then display the result. Can this be done?
 
 
The answer is YES. Instead of adding more search terms, you can do this all in an single search term.  When searching using "OR", simply put "||" (2 pipes) in between the terms you are searching.  For example, if you wanted to search for GWAVA or RETAIN, you would put in the search terms like this: '''GWAVA || RETAIN'''. Any subject that contain GWAVA ''or'' RETAIN will be displayed. The message may only contain one or the other value.
 
 
====Special Characters====
 
Special characters are optional when doing a search in Retain. But they can still be used. One special character has already been used in this module, the double pipe: "<b>||</b>". This is an <b>OR</b> expression to search for content that can contain any of the terms you are searching for. Here are other special characters that can be used in Retain (remember, they are optional):
 
 
::* <b>* (asterisk):</b>  Also known as the <b>wildcard</b>. Although you can just leave the search field ''blank'' and search to get the same result as when using the asterisk, Retain still recognizes this as a wildcard.  It can be helpful to search on everything within a particular value. *.pdf, or *.domain.com
 
::* <b>&&:</b>  This is another boolean expression and it means the same thing as "AND". You can simply use this or expand to another search box and it will do the same thing.  If you want to search on more than 6 items, you can use the "&&" in a single search term.
 
 
====Search Terms====
 
There is a drop down menu on what conditions you can search for. The search interface will remember the last item you search on until you clear the search. By default, subject is the first thing that will be shown. Here is a list and descriptions of each of the locations you can search for within a message: <br>
 
 
[[File:5._Conditions.png||||border|]]
 
<br>
 
 
 
::* <b>Subject:</b> This searches for words, or characters that are only in the subject.
 
::* Sender: (email): This searches for an e-mail address of the person who sent the e-mail ("From").
 
::* <b>Sender (display):</b> This will search on the name that is displayed in the viewing pane for the message. This could be the e-mail address, but usually is the actual name of the sender.
 
::* <b>Sender Domain:</b> This searches only for the domain (@domain.com). The @ symbol is implied and is not needed to perform the search.
 
::* <b>Attachment name:</b> This will search for the attachment name.  You can also include the type if you wish and it will bring up a list of all the types of the particular attachment (.pdf, .docx etc…).
 
::* <b>Recipient:</b> This searches for the person who has received the message ("To").  This could be the name of the recipient or his/her e-mail address.
 
::* <b>Recip. Domain:</b> This searches on the persons message for the domain only (@domain.com).
 
::* <b>Mail Server:</b>  This is the server name where the message was archived from. In other words, the name of the system that the message was archived from The Mail Server, or emailSystem, is found in the properties of the message under Additional Properties.
 
::* <b>Messaging Domain:</b> This is the domain that the message was transferred through before reaching the post office level.  The domain can be found in the properties of the message under Additional Properties.
 
::* <b>Location:</b>  This is the post office where the message was archived from.
 
::* <b>Internet Header:</b> If the message was received from the internet, it will contain  mime.822 attachment. This search feature can allow you to search within that internet header any content such as addresses, IP addresses, servers, domains, or any other content.
 
::* <b>Category:</b>  This is the type of message.  If the message has a category , this can be searched. The Category can only be searched when archived with the routing properties (see <b>Profile | Miscellaneous</b> to enable that feature).
 
::* <b>Message Contents:</b>  Anything within he message, and attachment, can be searched via this term.
 
 
<br>The next drop-down for the search terms indicates ''how'' you want the search performed. The selections are as follows:
 
 
::* <b>Contains(exact):</b>  Searching content with this parameter requires more definitive searching. You will have to type in exactly what you are searching for to receive accurate results. On the contrary, the contains (exact) will allow you to enter in partial words to be able to search the messages. However, the content must contain the terms you are searching for or it will not be able to find anything. This is the most accurate way to perform a search in Retain.
 
::* <b>Contains(fuzzy):</b>  Similar to exact, it will search a message that contains any terms you are searching for. The difference is, you don’t have to be as exact in your search. Anything that might resemble your keyword will be displayed. For example, I do a search for "GWAVA" that will pull anything and everything that looks like "GWAVA"; even if a text in a message reads: "GWAVARETAIN" (all run together) the fuzzy search will find it. The "Contains(exact)" will not find the "GWAVARETAIN", as it is not exact, but the fuzzy search will as it is more forgiving in its querying.  However, there are some issues with the fuzzy search and the current Lucene implementation was never clearly defined.  The result is that sometimes it can run forever and not return a result.  Some customers prefer not to give users the "fuzzy contains" search option (see our KB, [http://support.gwava.com/kb/?View=entry&EntryID=2163" Removing Search Terms]", on how to do this); or, if a search just seems to hang, they change it to "Contains(exact)".
 
::* <b>Word starts with:</b>  Phrases or even words that begin with certain characters can be searched. This can be a quick way to type in a few letters to come up with multiple entries that something starts with.  This is different from Contains (fuzzy) and (exact) in that it will only show messages that begin with those letters while the others might show messages that contain those letters anywhere within the word.
 
::* <b>Ends with:</b>  Similar to "Word starts with" except at the end - it works the same way.
 
::* <b>Does not contain:</b>  This is for any item that does ''not'' contain the phrase or term you are looking for.
 
 
<br>If you have trouble searching in one category, or location, try another.
 
 
====Mailboxes====
 
The second part of the Core section is the which mailboxes you wish to search. There are only two options: "All Mailboxes" and "Currently Selected".  "All Mailboxes" will obviously search the content in all mailboxes in the system. To select individual mailboxes, click the Select button and select which mailboxes you wish to search on. Make sure to select the appropriate radio button on the left in what you need.
 
 
 
[[File:6._Select_Mailbox.PNG]]
 
 
===Scope===
 
The scope section of the searching consists of three ways to search for messages: Item Type, Item Source, and the Attachment Size. Check the boxes on exactly what you want to search on. For Attachment Size, select in the drop down the size of attachment you are looking for. By default, everything is unchecked, which means that Retain will search on everything.
 
 
[[File:7._Scope.PNG||||border]]
 
 
===Sort===
 
The sort will display the results based on the Sort Results. You can Sort it by the creation date, delivered date,  subject, domain, sender etc… This is how it will display when after Retain finds results. You can sort it 3 times to help you view the messages how you want.
 
 
 
[[File:8.Sort.PNG||||border]]
 
 
===Misc===
 
The Miscellaneous section is used to define date ranges for appointments and tasks and/or item status for ''any'' type of item.  Notice there is a range for Start Date and End/Complete Date. Don’t let this confuse you.  This just allows you to search for messages that fall within a certain range for the start date, and for end date. Both Start Date and End date need to be specified to find exact dates.  Note:  The start date and end/complete date ranges only apply to appointments and tasks.  If you are not including appointments and/or tasks in your search, do not use the date ranges.
 
 
The final part of hit is looking for messages that have a particular status. If a message has been opened, read, private, or other this is where you can specify it. GroupWise sets the opened, read, and private statuses and they cannot be changed in Retain. By default, it is set on doesn’t matter. Also by default, the Misc. section for date ranges is set to any date.
 
 
If you ever encounter an issue with Retain not displaying all of the message that are searched, check the dates here or reset them. Don’t forget to check the calendar view as well and do these first before digging deeper into an indexing problem or thinking it is a bug in the program.
 
 
[[File:9._Misc.PNG||||border]]
 
 
===Reset===
 
The [[File:10._Reset.PNG]] button is as it states:  it resets all of the fields and search items back to default. Click that to start over with default values.
 
 
===Saving/Editing/Deleting Queries===
 
After you have run a query you have the ability to save that query in case you need to run it again.  Icons to load, save, share, and delete queries are located at the upper-left corner of the Search window.
 
[[File:12_LoadSaveEdit_Queries.PNG||center]]
 
 
To save a query, click the Save icon, give it a name, input a comment, and click Save.
 
 
[[File:13._Save_Query.PNG||||border]]
 
 
At a later time you can load this query by simply clicking on Load Query, highlighting the query, and clicking Load Selected Query.
 
 
[[File:14._Loadquery.PNG||||border]]
 
 
The query will only be saved for the user that is logged in. However, it can be shared with other users by clicking on Share Query, clicking on the icon to the left, and then adding members into the Group Membership. The saved queries will also show up in the Retain Publisher, making it easy to integrate and use the queries in that program.
 
 
Finally, you can delete queries by clicking on the Delete query icon, selecting the Query, and clicking on Delete.
 
  
 
=Viewing Results=
 
=Viewing Results=

Revision as of 23:28, 8 January 2015

Contents

Viewing Results

One tip in viewing search messages is to make sure the view is set to a date range to display the messages correctly. Click on the drop down menu and select the range (last 24 hours, 1 year, last 3 years); or, click on the calendar button and input a custom date range. If messages are not displaying after searching, check this first. It is vital that the view filter is set properly to display messages correctly.

2. Main Search--Date View.png


After performing a search, the messages will be displayed in the right window pane.

15. Search View.PNG


This is where you can select items to print, forward, export, or read. To view messages on a different page, click on Next. Click on Previous to go back to the previous page.

The headers at the top of the pane tell you details of the message. These headers are hard coded and cannot be changed, added, or edited. At this time, they also cannot be sorted by clicking on them. If you wish to sort a different way, go to the Sort section and then search again; or, go to Miscellaneous under the Options tab to sort or change the view. Clicking on any of the blue wording on From, Subject, or Recipients will allow you to view the message.

  • Type: This is the type of message that is being displayed. It displays in the form of an icon. The envelope icon is a simple mail message. It can be opened or closed, depending on if it was read on the email server prior to being archived. A message with a paperclip symbol next to it means the message contains an attachment.
  • QuickView: A feature that is only included in the Type part of the message is what is called the Quick View. Click on the icon to display a brief summary of what is in the message. This can make it easy to see what type of message it is, the subject, and simple text within the body of the message. It will not display full content however, such as attachment, To, and From information.
16. Quick View.PNG
  • From: This displays is who the message was from (the sender).
  • Subject: This is the exact subject that is displayed for the message archived from the email system.
  • Recipients: This is a list of users that the message was sent to. If it is in blue and has a + sign next to it, that means there were multiple recipients, including CC and BCC. Hover the mouse over the plus sign to view the other recipients of the message.
  • Date: This is the creation date of the message. For appointments, the date will actually be the stored date in Retain.
  • Mailbox: This category is the mailbox the message was archived from. Don’t get confused with the sender (from) or recipient (to). This is where the message was originally located in the email system when it was archived by Retain.
  • Folder: This is the folder that the message was originally located in the email system and will match exactly the same folder in the Retain system.

How It Works

Source of the Data

Unlike when in the Browse tab, which gets its data strictly from the Retain database, when in the Search tab, the data is coming from the Lucene indexes. If anything is missing or incorrect, it is the Lucene indexes you'll want to troubleshoot.

See KB, "Where Data is Stored in Retain" for more information.

See the How It Works topic for a deeper discussion on indexes.


Back to Retain Mailbox
Personal tools
Namespaces

Variants
Actions
Home
Exchange
GroupWise
JAVA
Linux
MTK
Retain
GW Monitoring and Reporting (Redline)
GW Disaster Recovery (Reload)
GW Forensics (Reveal)
GWAVA
Secure Messaging Gateway
GW Mailbox Management (Vertigo)
Windows
Other
User Experience
Toolbox
Languages
Toolbox