Microsoft Office Tutorials: Create and run queries in the eDiscovery Center

Wednesday, January 24, 2018

Create and run queries in the eDiscovery Center

Once you have defined your sources, and placed them on hold if necessary, you can run queries to narrow down and extract exactly the content you need for a particular case.

Efficient queries can make it much easier for you and other people involved in the case to manage the content, because it reduces the overall volume and helps ensure that the content that you deliver is more likely to be relevant.

Before creating queries, you should add content sources to your case. Find more information about working with content sources in the article Add content to an eDiscovery case and place sources on hold.

Note: A query can contain a maximum of 1,500 Exchange sources, 100 SharePoint sources, and 500 keywords.

By default, a query searches across all content sources, you can choose which discovery sets or sources a query searches if you don't need to search them all, which can make your queries run faster. You can also refine your queries in other ways. For more information, see Searching and using keywords in eDiscovery.

If your case is not already open, in an eDiscovery Center, click Cases, and then open the case you want to create queries for. The case should already have content sources, such as Web sites and mailboxes.
In the Search and Export section, under Queries, click New Item.
Type a descriptive name for your query.
In the Query box, type the keywords you want to use to narrow down your query. Find tips for writing queries in the See Also section.
To narrow down content by a date range, enter the Start Date and End Date.

Note: If you type the dates in the Start Date and End Date boxes, use the format mm/dd/yyyy; for example, you would use 03/01/2013 to specify March 1, 2013. Use the mm/dd/yyyy format even if the regional settings on the local computer are configured with a different format, such as dd/mm/yyyy. Alternatively, select the start and end dates using the date picker.

To limit results to the author of a document or list item, or to a specific sender of e-mail messages, type the names or e-mail addresses in the Author/Sender box.
If you have multiple sources and Discovery Sets, but don't need to search them all, click Modify Query Scope. Then, specify the discovery sets or content sources you want.
To narrow down your query by specific types of content, click the Exchange or SharePoint tabs, and then select the checkboxes for the type of content you want. For example, you can select only calendar items for Exchange or only PowerPoint slides for SharePoint.
To analyze or further refine your query, click Advanced Query Options., and do one or more of the following.
- To remove redundant Exchange data, such as e-mail messages that are returned more than once by different terms, select Remove redundant Exchange data.
- To examine the syntax and structure of your query, view the Exchange Query, and SharePoint Query sections, and the table of sources that shows filters, queries, and refiners,
When you are ready to run your query, click Search. The results are ranked based on relevance, such as how frequently a search term appears.

Note: Once you add queries or content sources to an eDiscovery case, changing the regional settings for the site is not supported.

Top of Page

Add more content sources while creating a query

On the Query:New Item page, in the Sources section, click Modify Query Scope.
In the dialog box that appears, click All case content,
Click Add mailbox for Exchange content or Add location for SharePoint content.
Specify the person's mailbox or Web site you want to add.
Click OK.

Note: If you update a query and rerun it, only the first page of the new results will be refreshed. If you are viewing multiple pages of query results, and you are not viewing the first page, the page will not be refreshed with the new results.

Top of Page