Searches (Preserve)

The Searches (Preserve) page displays sets of documents with similar attributes based on search criteria created for searchers within Preserve.

  1. Searches menu bar: Enables you to:
    • Unsaved: View unsaved searches in the Searches list.
    • Only Mine: View only searches generated by the current user in the Searches list.
  2. Search Summary: View details of the search, including the search criteria used to generate results, as well as edit the Name, Privacy, and Description and State.
  3. Action icon: Enables you to:
    • Edit: Opens the Search dialog box with the criteria used to generate the results.
      To edit a search, update the criteria on the Search dialog box and click Search.
    • Delete: Delete the search.
    • Copy: Copy the search criteria in the Search dialog box as the basis of a new search.|
      To copy and edit a search, update the criteria on the Search dialog box and click Save. Complete the Save Search dialog box and click Save. On the Search dialog box and click Search.

To search within Preserve

  1. In the Nebula menu bar, click Preserve > Nebula Big Data > Searches and select one of the following:
  2. In the Nebula menu bar, click the magnifying glass icon.
  3. On the Search dialog box, select the Store Type you want searched:
    • Email
    • File
    • Sharepoint

    Note: You can only search Store Types for which you have data in Nebula Big Data.

  4. If you choose, select Keywords and enter a Boolean-style search string to locate documents. Keyword searches can include:
    • Boolean operators (AND, OR, NOT)
    • Grouping (using parentheses)
    • Wildcards
    • * indicates 0 or more characters
    • ? indicates a single character
    • Phrases (using quotes)
    • Fuzzy search (using ~)
  5. Select the fields you want searched.

    6. Note: If multiple fields are selected, the AND operator is used to combine them in the search.

    For Email store types...

    Fields Description
    Identities

    Depending on the source of the email data, these will be:

      • The names of the mailbox owners (Exchange/Exchange online)
      • The name of the PST owner (if known when the data was ingested)
      • The SMTP addresses of senders/recipients from recognized domains found in the data (for PSTs/EML if owner was not known at ingestion time)
    Sender Searches the From field. Enter a partial or complete email address or display name. Supports Boolean operators and wildcards.
    Recipient Searches the To, Cc, and Bcc. Enter a partial or complete email address or display name. Supports Boolean operators and wildcards.

    Examples of Sender and Recipient:

    • john.smith
    • somecompany.com
    • john.smith@somecompany.com
    • "John Smith"
    Subject Searches the email subject. Supports Boolean operators, wildcards, and phrases.
    Sent Date Limits results based on the date the message was sent.
    Received Date Limits results based on the date the message was received.
    Has Attachments Choose Yes to return only items with attachments or No to only return items without attachments.
    Item Class

    Enter the message class ID to display the item. (Examples: IPM.Note limits results to only emails, PM.DistList limits results to only distribution lists). For more information, see Item Types and Message Classes.

    Note: Applies only to Exchange/Outlook email data.
    Size Limits results to emails larger or smaller than a selected size.

    For File store types...

    Field Description
    Locations Search for results in a specific NBD path.
    Item Name

    Search the file name. Supports Boolean operators, wildcards, and phrases.
    Item Type

    Search for files with specific extensions. Supports Boolean operators and wildcards.
    Created Date Limits results based on the date the file was received.
    Modified Date Limits results based on the date the file was modified.
    Accessed Date Limits results based on the date the file was accessed.
    Size Limits results to files larger or smaller than a selected size.
  6. To save the search on the Searches page (Preserve > Nebula Big Data > Searches), on the Searches dialog box, click Save and do the following:
    • On the Save Search dialog box, enter a Search Name.
    • Select the level of access of the saved search:
    • Public: All users.
    • Firm: A group of predefined users.
    • User: Only the user who created the redaction.
    • If you choose, enter a Description of the search.
  7. On the Search dialog box, click Save, then click Search.
  8. View the Search Results.