Using SmartCloud Archive Essentials

Second Edition

August 2012

Graphic border

About this edition

In keeping with IBM's commitment to accessibility, this edition of the product documentation is accessible.

Printing

When you print this document some of the style elements are removed to create a better print output. Here are a few tips about printing:
  • The document length may exceed the browser's print capability. Microsoft Internet Explorer has demonstrated the ability to print large files successfully.
  • This document is long. Use print preview to determine the printed page length.
  • You can highlight section of the document and then choose to only print the selected content

Working offline

You can save a local copy of this document from your browser. Each browser has different menus and menu options. Consult the browser help if you need assistance saving the document locally.

Submitting feedback

If you would like to provide feedback about this document, see the Documentation Feedback Web site.

Getting started

If your company purchases an IBM SmartCloud™ Archive Essentials subscription, you can archive and retrieve the email of IBM SmartCloud Notes® users for legal purposes. Retrieval occurs through secure HTTPS access to the archive.

About this task

Note: Currently, SmartCloud Archive Essentials does not provide end-users with access to their archived mail.

Company administrators enable the use of the archive service. A company administrator is someone who has a SmartCloud for Social Business user account and the Administrator role. Through user account selections, company administrators specify whose email is archived and who can work with the archived email.

To specify who can work with archived email, company administrators assign one of the following e-Discovery roles to user accounts:
  • e-Discovery administrator: Allows someone to search the archive to retrieve messages that match search queries and give e-Discovery users access to the search results.
  • e-Discovery user: Allows someone to work with search results generated by e-Discovery administrators.

For example, a department head in your organization might need to view the email messages sent and received by three users in your company during the past year. An e-Discovery administrator can search the archive for those messages and then give the department head access to the search results. The department head, who has the e-Discovery user role, can view and work with the messages in the search results.

The archive service can be used to search, retrieve, classify, download, export, forward, and audit archived messages.

The browser requirements to use the service are the same as the browser requirements to use the SmartCloud Notes web client. For more information, see the SmartCloud Notes web requirements.

Assigning e-Discovery roles

A company administrator enables people to work with archived mail by assigning an e-Discovery role to their user accounts.

Before you begin

To assign e-Discovery roles, your company must purchase an IBM SmartCloud Archive Essentials subscription and you must have the Administrator role in your IBM SmartCloud for Social Business user account.

About this task

You can assign one of two e-discovery roles: e-Discovery administrator or e-Discovery user. e-Discovery administrators search the archive and give e-Discovery users access to the search results.

A user does not require a SmartCloud Notes subscription to be assigned an e-Discovery role.

This procedure describes how to assign an e-Discovery role to an existing SmartCloud for Social Business user account. You can also assign the role when you first add the user to the service.

Procedure

  1. Log on to the IBM SmartCloud for Social Business web site at https://www.ibmcloud.com/social as a user assigned the Administrator role in the service user account.
  2. If your user account is also assigned User role, click Administration > Manage Organization from the dashboard.
  3. Click User Accounts in the navigation pane.
  4. Click Edit User Account.
  5. In the User Information tab, select the e-Discovery administrator or e-Discovery user role.
  6. Click Next, click Next again, and then click Finish.

Comparison of e-Discovery roles

e-Discovery administrators can perform some tasks that e-Discovery users cannot perform. The following table describes the tasks allowed by each e-Discovery role.
Table 1. e-Discovery tasks by role
Task e-Discovery administrator e-Discovery user
Create searches to show archived email messages that match search criteria. Yes No
Give e-Discovery users permission to work with search results. Yes No
Edit search results Yes Yes, if given Change Scope permission to search results.
View search results. Yes Yes, if given Access permission to search results.
Forward messages in search results. Yes Yes, if given Access permission to search results.
Tag messages to flag or group them. Yes Yes, if given Access permission to search results.
Create system tags that can be used in multiple searches. Yes No
Filter search results to display a smaller set of messages. Yes Yes, if given Access permission to search results.
Add comments. Yes Yes, if given Access permission to search results.
Export messages to a Notes application (.NSF file). Yes Yes, if given Export permission to search results.
Place legal holds on search results. Yes Yes, if given Access permission to search results.
Generate summary reports of search results. Yes Yes, if given Access permission to search results.
Audit search results activity. Yes No

Enabling archiving of user email

A company administrator enables archiving of an IBM SmartCloud Notes user’s email through a selection in the IBM SmartCloud for Social Business user account.

Before you begin

The user account of the user whose email you are archiving requires a SmartCloud Notes subscription.

To enable archiving, your user account requires the Administrator role.

About this task

Inbound and outbound messages, both internal and external, are archived, including deleted messages. The archived email remains in the archive indefinitely.

This procedure describes how to archive the email of a user who already has a user account in the service. You can also enable archiving at the time you create the user account.

Procedure

  1. Log on to the IBM SmartCloud for Social Business service at https://www.ibmcloud.com/social.
  2. If your user account also has the User role, click Administration > Manage Organization from the dashboard.
  3. Click Edit User Account.
  4. Click Next.
  5. In the Subscriptions tab, select the E-mail Archive Essentials add-on.
  6. Click Next and then click Finish.

Results

The current content of the user’s mail file is archived within 24 hours. As new messages are sent and received, they are added to the archive.

Logging on to the archive service

To work with archived mail, log on to the archive service as an e-Discovery administrator or an e-Discovery user.

About this task

An e-Discovery user must log on to the archive service one time to be shown in the list of users that e-Discovery administrators can assign to search results.

Procedure

  1. Log on to https://www.ibmcloud.com/social with your SmartCloud for Social Business logon email and password.
  2. Click Apps > e-Discovery.

Accessibility

No special accessibility features are provided in IBM SmartCloud Archive Essentials. All OS level keystrokes for accessibility are recognized. For the best accessibility experience, use Mozilla Firefox 3.6 or higher and JAWS 12 or higher.

Searching the archive

To search the archive, provide search criteria and a name under which to save the search results. Optionally, give e-Discovery users permission to work with the search results.

About this task

You must be an e-Discovery administrator to perform this task.

e-Discovery administrators have access to search results generated by other e-Discovery administrators.

Procedure

  1. Log on to the archive service as an e-Discovery administrator.
  2. From the Dashboard tab or the Search tab, click Start new search.
  3. Select the tab that corresponds to the type of search you want to perform (Simple, Wizard, Advanced, or Custom.)
  4. In the Name field, type a name for the search results.
  5. Enter a search query using the procedure documented for the type of search you selected.
  6. Optional: In the Dates fields, select a range of dates.

    Only messages meeting the search criteria and created within the range are returned. If you do not specify a range of dates, all messages in the archive are searched.

  7. Optional: Click the Tags field and perform either of the following steps to assign tags to all messages in the search results.
    • Type a new tag.
    • Select an existing tag, if available, that was recently assigned to other search results pages.
  8. Optional: Perform the following steps to give e-Discovery users permission to work with the results of this search.
    1. Click the Permissions field to see a list of e-Discovery users.
      Attention: e-Discovery users must log on to the archive service at least one time to appear in this list.
    2. Next to the name of an e-Discovery user to be allowed access, select any of the following permissions.
    Permission Description
    Access Allows e-Discovery users to view and sort the search results.
    Change Scope Allows e-Discovery users to edit search results.
    Export Allows e-Discovery users to export messages in search results to a Lotus Notes database (.NSF) file.
  9. Optional: In the Note field, write a comment about the search for users to see.
  10. Click one of the following options.
    Option Description
    Save and display results Saves the search and shows the search results.
    Save and return to list Saves the search results and returns to the list of saved search results.

Entering search queries in Simple searches

Simple searches are used to search for terms without using logical operators. When creating or editing a Simple search, type each term to search for in the Search Terms field of the search form.

Separate multiple terms with commas (,). If you specify multiple terms, messages that contain any of the terms are returned in the search results.

To search for an exact phrase, enclose the phrase in quotation marks ("), for example, "Renovations Inc" .

Entering search queries in Wizard searches

When you use Wizard searches, create search conditions by selecting from predefined options that search specific parts of messages. Wizard searches are the most common types of searches.

You can type terms to search for or select a search list that contains terms. You can create a search list in advance or as you create the search.

Example

The following examples demonstrate the use of Wizard search queries.
Table 2. Examples of Wizard search queries
Condition Field 1 Condition Field 2 Condition Field 3 Condition Field 4
Sender Does Contain Brown*
Body Text Does not Contains items from a list HR Audit list
Person Does Contain the phrase Allen Brown

Creating search lists

e-Discovery administrators can create search lists that contain search terms that are frequently used in Wizard searches. Use search lists to avoid the need to retype frequently used search terms.

About this task

Add terms, addresses, or domain names to a search list.

Procedure

  1. Log on to the archive service as an e-Discovery administrator.
  2. Click the Settings tab.
  3. Click the Search Lists tab.
    Tip: You can edit or delete search lists from here.
  4. Click Create new list.
  5. Enter a name for the list.
  6. Type the terms to include in the list. Separate terms with a comma (,). Enclose an exact phrase in quotation marks (").
  7. Click Create.

Results

When creating or editing a Wizard search, use the Contains items from a list option to select the list.

Entering search queries in Advanced searches

When you enter search queries in Advanced searches, you specify terms to search for in specific message fields.

Procedure

When searching the archive using Advanced search, enter search criteria in the fields in the Search Options section of the New Search or Edit Search window. The following table describes the fields in this window.

There is an AND relationship between the fields to search in messages (Subject, Sender, Recipients, Attachment name) and the search terms specified through the Has words and Do not have words fields in the window.

Field Description
Subject

Type words to search for in subject lines of messages.

To find an exact phrase, put quotation marks (" ") around the phrase.

Sender

Type full or partial email addresses to search for in the sender field of messages.

Examples:
  • Specific sender: sdaryn@renovations.com
  • Senders from one company domain: *@renovations.com
  • Senders with the term smith in their addresses: *smith@company.com
Recipients

Type full or partial email addresses to search for in the recipient fields of messages.

See examples for the Sender field.

Has words

Type terms to search for in the body of messages or attachments that search results must contain.

Select Look into: message body to search for terms in the body of messages. Select Look into: attachments to search for the terms in message attachments. There is an OR relationship between these two fields. Select both options to search in the body and in attachments.

Note: In this field, the first character in search terms cannot be a wildcard.
Do not have words

Type terms to search for in the body of messages or attachments that search results must not contain.

Select Look into: message body to search for the term in the body of messages. Select Look into: attachments to search for the term in message attachments. There is an OR relationship between these two fields. Select both options to search in the body and in attachments.

Note: In this field, the first character in search terms cannot be a wildcard.
Attachment name

Type a full or partial file attachment name to find messages with attachments of that name, for example expense.xls or expens*.xls

Example

The following table provides examples of conditions in Advanced search queries.
Table 3. Examples of conditions in Advanced search queries
Condition Search results

Sender Jasmine Haj

Subject SEC

Returns messages in which the sender field contains the term Jasmine Haj, Jasmine, or Haj and the subject line contains the term SEC.

Sender "Jasmine Haj"

Subject SEC

Has words Confidential with Look into: message body and Look into: attachments selected.

Returns messages in which the sender field contains the term Jasmine Haj, the subject line contains the term SEC, and the message body or an attachment contain the term Confidential.

Wildcards in search terms

You can use wildcards when entering search terms in any type of search.

Use the asterisk (*) wildcard to represent any string of characters. An asterisk must be used with at least five characters. An asterisk (*) can be used as the first character in a query in the following search fields only:
  • Sender
  • To, cc, bcc
  • Subject
  • Attachment name

Use the question mark (?) wildcard to represent any one character.

Table 4. Examples of the asterisk (*) wildcard
Example Description
contrac* Finds any term that begins with contrac, for example:

contract
contractual
contracted

*renovations.com Finds any term that ends with renovations.com, for example:

sdaryn@renovations.com
sales@renovations.com

*43931 Finds any term that contains the sequence 43931, for example:

$43931.00
9543931226

Table 5. Examples of the question mark (?) wildcard
Example Description
"???? ???? ???? ????"
Finds any term that contains four sets of characters with four characters in each set and with a single space between sets, for example:

4417 1234 5678 9012

This query is commonly used to search for credit card numbers.

"???\-??\-????"
Finds any term that contains a set of three characters, followed by a hyphen, followed by two characters, followed by a hyphen, followed by three characters, for example:

123-45-6789

This query is commonly used to search for social security numbers.

Note: The hyphen (-) is a reserved character, so it is preceded by a backslash (\).
?inks Finds any term that begins with any single character followed by the string inks, for example:

links
rinks
but not
drinks

"well gra?e?""
Finds any phrase that begins with the term well followed by a space, followed by the string gra, followed by any character, followed by the character e followed by any character. For example:

well graded
well grates

The quotation marks (") indicate a search phrase.

Syntax for searching reserved characters

Some characters are reserved for search query functions. To search for one of these characters, "escape" it by preceding it with a backslash (\).

Precede any of the following characters with a backslash (\) when searching for them:
+ - & | ! ( ) { } [ ] ^ " ~ * ? : \
The following examples illustrate queries that search for reserved characters. These examples show a Simple search query, but the syntax is supported for other types of searches.
Table 6. Examples of queries that search for reserved characters
Search query Description
body:1\(555\)555\-1212 Searches for messages that contain 1(555)555-1212 in the body.
subject:promotion\? Searches for messages that contain promotion? in the subject line.

Working with search results

After e-Discovery administrators save searches, they, and e-Discovery users who are given access to the searches, can perform a variety of tasks to work with the search results.

Controlling the display of all messages in search results

There are several features to use to control the display of all messages in search results.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Open a search results page from the list.
  3. Use any of the features in the following table.
    Table 7. Features that control the display of messages
    Feature Steps

    Show only header (sender, recipients, subject) and attachment information in messages. Use this option to help you browse a large set of search results.

    1. Next to Messages, click Mini view.
    2. Browse the list of messages.
    3. To see the body of messages again, next to Messages, click Normal.

    Show only the parts of each message that contain search terms.

    1. Next to Messages, click Collapse All.
    2. To see entire messages again, click Expand All.

    The Collapse All and Expand All options are available only when their are highlighted terms in the body of messages that match the search query.

    Display the status On Legal Hold next to messages in the results that are on legal hold and the total number of messages in the results that are on legal hold.

    Click Show Legal Hold Status.

    Sort search results

    Next to Sort results by, click any of the following options:
    • Relevance. Sorts messages by their relevance to the search criteria. Relevance ranking is approximate and takes into account the number and complexity of search terms and the number of matches.
    • Date. Sorts messages by their date stamps.
    • Sender. Sorts messages by name of sender, by family name, if available.
    • Subject. Sorts messages alphabetically by subject.
    • # of Attachments. Sorts messages by the number of attachments they contain.

    Click the selected option to switch between ascending and descending sort order.

Viewing and acting on individual messages

From an individual message in search results, you can show just the part that contains search terms, output the message to a PDF or .NSF file, mail the message to yourself or someone else, and preview and download attachments.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Open a search results page from the list.
  3. From a message, perform an action described in the following table.
    Table 8. Actions for individual messages
    Action Steps

    Show parts of the message that contain highlighted search terms. Strip out MIME or HTML formatting; show only attachment file names.

    Click the Text view tab.

    Show the entire message, including MIME or HTML formatting, and enable previewing and downloading of attachments.

    Click the Original view tab.

    Create and download a PDF version of the message.

    Click To PDF.

    Export the message to a Lotus Notes database (.NSF) file.

    Note: e-Discovery users require Export permission to the search results.

    Click Download. A compressed file, message.zip, is created for you to download.

    Mail the message to someone.

    Click Send, address and write a message, and click Send Now.

    Send the message to your Inbox.

    Click Recover.

    Preview the contents of an attachment.

    The preview feature is available for the following types of attachment formats:
    • .doc
    • .docx
    • .xls
    • .xlsx
    • .xlr
    • .ppt
    • .pptx
    • .rtf
    • .pdf
    • .wpd
    • .wps
    • .pps
    • .ps
    • .eps
    • .ai
    • .odt
    • .ods
    • .odp
    1. (Optional) In the search results, click Sort results by: # of Attachments
    2. From the message, click the Original view tab.
    3. Next to the attachment name, click Preview.

    Download an attachment.

    1. (Optional) In the search results, click Sort results by: # of Attachments
    2. From the message, do either of the following steps:
      • Next to the Attachments field, click the attachment name.
      • Click the Original view tab and next to the attachment name, click Download.

Tagging search results

Tag messages to flag them or to enable you to view and act on multiple messages with the same tag at once. Use the pre-defined tags Save, Starred, Reviewed, Attention or use tags that you or others create.

Tagging individual messages

You can use pre-defined tags or custom tags to tag individual messages in search results.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Open a search results page from the list.
  3. From an individual message within the search results, use any option in the following table to add a tag to the message.
    Table 9. Options for tagging individual messages
    Option Steps
    Add a pre-defined tag.

    Click the Save, Reviewed, Starred, or Attention icons to add a tag of that name.

    To remove the tag, click the icon again.

    Create and add a custom tag.

    In the text box below the TAGS section, type the name of a new tag and click Save.

    The new tag is added to the message and shown in the tags box.

    If you expand the TAGS section, the new tag is also shown in the Previous Tags field so that it can be added easily to other messages in the search results

    Add a custom tag previously created for these search results.
    1. Expand the TAGS section.
    2. Select a tag in the Previous Tags field.
    3. Click Save.

    The tag is added to the message and shown in the text box.

    Add a system-wide tag that was previously added by an e-Discovery administrator through the Settings > System Tags tab of the service.
    1. Expand the TAGS section.
    2. Select a tag in the System Tags field.
    3. Click Save.

    The tag is added to the message and shown in the text box.

  4. To remove a custom or system tag from a message, delete the tag from the text box in the TAGS section. If other tags remain in the text box, click Save to update the tag assignment.

Creating system tags

e-Discovery administrators create system tags. System tags are used to tag individual messages and can be used in multiple search results pages.

Procedure
  1. While logged on to the archiving service, click the Settings tab.
  2. Click System Tags.
  3. Enter the name of the tag and click Add Tag Word.
Results
e-Discovery administrators and e-Discovery users can add the system tag to individual messages.

Tagging all messages in a search results page

In a search results page, you can add the same tag to all messages at once.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Open a search results page from the list.
  3. In the Tagging field, select an option described in the following table to add a tag to all messages in the set of search results.
    Option Description
    Add > Review to all this page Adds the predefined tag Reviewed to all messages in the search results page.
    Add > Attention to all this page Adds the predefined tag Attention to all messages in the search results page.
    Add > Star to all this page Adds the predefined tag Starred to all messages in the search results page.
    Add > Save to all this page Adds the predefined tag Saved to all messages in the search results page.
    Add > Tag word to all this page Adds a tag that you specify to all messages in the search results page.
  4. To remove a tag from all messages, repeat the previous step but select the Remove option. For example, select Remove > Review to all this page.

Viewing messages in a search results page by tag

You can view all the messages in a search results page that are assigned the same tag.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a search results page, click Views.
    Tip: Or from within the search results page, click Tagged views.

Results

Each tag used in the search results is displayed as a link preceded with an asterisk (*) and followed by the number of messages assigned the tag. For example, the following link is displayed if four messages are assigned the Attention tag: *Attention(4)

To see the messages assigned a tag, click the tag link.

Filtering search results

Filter search results to narrow a page of search results by specified criteria. Filtered results are saved and can be exported or marked for legal hold.

The messages found in the original search results are still available after filtering.

Filtering is a good option for e-Discovery users who do not have Change Scope access to a search.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Open a search results page from the list.
  3. Click Filter My Results.
  4. Specify any of the following filtering options.
    Option Description

    DATE RANGE

    Finds messages created within a selected time period.

    SENDER AND RECIPIENTS

    Finds messages sent or received by specified people. You can specify names and email addresses in the fields in this section. You can use wildcards in these fields.

    ATTACHMENTS

    Finds messages with attachments, and optionally, attachments with specific file names. You can use wildcards when searching for attachment names.

    FILTER NAME

    Specifies a name for the filter. If you do not specify a name, the service generates the name unamed-n, where n is sequential number.

    BODY AND ATTACHMENTS

    Find messages with specific terms in the subject, message body, or attachments.

    There is an AND relationship between the terms specified in the Has words and Does not have words fields in this section.

    There is an OR relationship between terms in the Subject field and terms in the Has words,Does not have words fields.

    You can use wildcards in these fields.

  5. Click Apply.

Results

The results of the filter, if any, are displayed. To change the filter, click Edit Current Filter. To cancel the filter, click Clear Filter.

Managing filtered search results

You can see all the filters created for a search results page. You can see the messages found by a filter, edit a filter, delete a filter, and export and place legal holds on messages found by a filter.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a search results name, click Views.

    The Filters section of the window that opens lists each Filter and the number of messages in the filter. This section is not displayed if a search has no filters.

  3. Perform any of the following actions on a filter.
    Table 10. Filter actions
    Action Steps
    Edit a filter and generate new results.
    1. If the filter is not open, click the link to the filter to open it.
    2. Click Edit Current Filter.
    Delete a filter Next to a filter, click Delete.
    Place a legal hold on messages found by the filter.
    1. If the filter is not open, click the link to the filter to open it.
    2. Select Legal Hold Actions > Place all results on legal hold.
    .
    Remove a legal hold from messages found by the filter.
    1. If the filter is not open, click the link to the filter to open it.
    2. Select Legal Hold Actions > Removal all results from legal hold.
    Export messages found by the filter to a Lotus Notes database (.NSF). Next to a filter, select Export to: NSF.

Adding and monitoring comments

You can add comments to search results pages and to individual messages. You can use an RSS feed reader to monitor comments. Commenting activity is reported when e-Discovery administrators perform search audits.

Adding comments to search results pages

To communicate with others who are working with a search results page, add comments to the page.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a named search in the list, click Views to see comments.
  3. Perform any of the following actions.
    Table 11. Actions for commenting on search results pages
    Action Steps
    Add a comment. Click Add Comment, type a comment, and click Save.
    Edit a comment. Next to a comment, click Edit, edit the comment, and click Save.
    Delete a comment. Next to a comment, click Delete, edit the comment, and click Save.

Commenting on individual messages

Anyone with access to a search results page can comment on a message in the results.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Open a search results page from the list.
  3. From a specific message, perform any of the following actions:
    Table 12. Commenting actions for a specific message
    Action Steps
    Add a comment to the message. Click Add Comment, type a comment, and click Add Comment again to save the comment.
    Edit a comment previously added to the message.
    1. Expand the Comments section.
    2. Next to a comment, click Edit, edit the comment, and click Update Comment.
    Delete a comment previously added to the message.
    1. Expand the Comments section.
    2. Next to a comment, click Delete and click OK to confirm.

Monitoring comments using an RSS feed reader

If you have installed an RSS feed reader, you can use it to monitor comments added to search results pages or to individual messages.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a named search in the list, click Views.
  3. In the Search comments section of the Views page, subscribe to the Comments feed.

Editing search results to generate new results

You can edit search results to generate new results. e-Discovery users require the Change Scope search permission to perform this task.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to the search results to change, click Edit.
  3. Change the search criteria.
  4. Click one of the following options:
    Option Description
    Save as a new search Saves the new search results under a new name that you provide and show the new results.
    Save and display results Overwrites the current search results and shows the new results.
    Save and return to list Overwrites the current search results returns to the list of saved searches.

Generating search summary reports

You can see reports that summarize the results of saves searches and, optionally, generate PDF versions of the reports.

About this task

A report shows:
  • Type of search
  • Date range searched
  • Number of matching messages
  • Tags used and the number of messages assigned to each tag

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a named search in the list, click Summary. The report is displayed.
  3. Optional: To generate a PDF version of the report, specify whether to include search results (number of matching messages) and tags in the report, and then click PDF.

Auditing search activity

You can see a record of each action performed on a search results page. For example, you might review the actions of an e-Discovery administrator who was recently fired.

About this task

An audit record shows the following information about each action performed on a search results page:
  • Person
  • Date and time
  • IP address
  • Type of action

You can export the audit record to a .CSV (commas separated value) file, and from there import into another file, such as a spreadsheet.

You must be an e-Discovery administrator to audit search activity.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a search results page in the list, click Audit.
  3. Review the activity report.
  4. Optional: Click Export to CSV file.

Exporting search results

You can export messages found in search results to an IBM Lotus Notes database (.NSF) file. Export all messages, messages with particular tags, or messages in particular filter results.

About this task

The length of time required to export a file and make it available for download depends on the total size of the messages that are being exported. Export processing usually takes less than four hours.

Exports must contain less than 15,000 messages or less than 3.5 GB of data. If the export exceeds the limits, divide search results into smaller sets and export each set.

To perform this procedure, e-Discovery users require the Export search permission.

Procedure

  1. While logged on to the archiving service, click the Search tab.
  2. Next to a named search in the list, click Views.
  3. Perform one of the following actions to select the messages to export:
    Table 13. Selecting messages to export
    Action Steps
    Export all messages found in search results page. In the Views section, next to All, select Export to: NSF.
    Export messages that are assigned the same tag.

    In the Views section, next to a tag name, select Export to: NSF.

    Tag names begin with an asterisk (*), for example, *Attention.

    Export messages in filtered results.

    In the Filters section, next to filter name, select Export to: NSF.

    Note: If the NSF button does not show next to the Export to field, the service has detected that the selected content exceeds the size limit.
  4. Optional: In the Note field, enter a note to yourself as an administrative reminder.
  5. Optional: Select Send notification when the file is ready for download to receive an email notification when the file is ready to be downloaded.
  6. Click Export to queue the export request.
  7. Next to the message The export was successfully created, click exports for this search to see the status of the export. The following table describes the status messages you might see.
    Status message Description
    Queued

    The request is queued for processing. The person who performed the export receives an email notification.

    Processing

    The exported file is being created.

    Ready

    The exported file is ready to be downloaded. The person who performed the export receives a notification if the Send notification when the file is ready for download option was selected.

    Contact Support

    The service was unable to complete the export. This status usually indicates the presence of corrupted messages in the archive.

    The person who performed the export and the Support team receive email notifications.

    Support strives to address the issue within one day of receiving the notification. However, for urgent exports, contact Support for immediate assistance.

    Exceeds Size Limits

    During processing, the service determined that the file is larger than 3.5 GB or contains more than 15,000 messages. The person who performed the export receives an email notification.

    To continue, generate multiple, smaller sets of search results and export each set separately.

    Tip: You can also see the export status by opening a search results page and clicking Pending Exports or by clicking Dashboard and viewing the Recent exports section.
  8. When the export status is Ready, to download the file, click the link to the export file in the status page or in the email notification.

Results

The file is downloaded and the export request is removed from the list of pending exports.

Examples of dividing search results that exceed export size limits

If search results exceed the export limit of 15,000 messages or 3.5 GB of data, divide the results into smaller sets and then export each set.

The typical way to divide search results into smaller result sets is by date range. You might use filtering to experiment with different date ranges to find the optimum range for export. For example, experiment with searches by week, by month, by quarter, or by year.

Example of exporting all mail sent between July 1 and August 31 (20,000 messages):
  • Create a search or filter for all mail sent between July 1 and July 31 and export the results. (10,000 messages)
  • Create a search or filter for all mail sent between August 1 and August 31 and export the results. (10,000 messages)

Example of exporting all mail that jdoe@acme.com sent or received in 2009, 2010, and 2011 (85,000 messages):

  • Create a search or filter for all mail jdoe@acme.com sent or received between January 1, 2009 and June 30, 2009 and export the results (14,000 messages)
  • Create a search or filter for all mail jdoe@acme.com sent or received between July 1, 2009 and December 31, 2009 and export the results (16,000 messages)
  • Create similar searches or filters for the years 2010 and 2011.

Notices

This information was developed for products and services offered in the U.S.A.

All references to Renovations refer to a fictitious company name and are designed for illustration purposes only.

IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-IBM product, program, or service.

IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to:

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan Ltd.
1623-14, Shimotsuruma, Yamato-shi
Kanagawa 242-8502 Japan

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious, and any similarity to the names and addresses used by a real business enterprise is entirely coincidental.

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

IBM Corporation
5 Technology Park Drive
Westford Technology Park
Westford, MA 01886
U.S.A.

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.

All IBM prices shown are IBM's suggested retail prices, are current and are subject to change without notice. Dealer prices may vary.

This information is for planning purposes only. The information herein is subject to change before the products described become available.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

If you are viewing this information softcopy, the photographs and color illustrations may not appear.

Trademarks

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

End of document