Error Message

This issue is caused by a backlog of items that have been archived but are waiting to be indexed.

The use of the Since search last ran option takes the previous search instance's run date and uses that as the beginning date of the next instance's search date span.  This new instance uses its previous day's date as the end of the search date span by default.

For example, a once per week scheduled search using this option ran on 2019-06-01 with a search date span of 2019-05-25 through 2019-05-31.  The next instance of this search would run on 2019-06-08 with a search date span starting on 2019-06-01 and ending on 2019-06-07.

If an indexing backlog exists where items are archived one day but indexed the next day, use of the Since search last ran option could cause items to be missed.

Using the above example, any items that were created and archived on 2019-05-31 but not indexed until after 00:00:00 hours on 2019-06-01 would not be included in that search run nor any following instances of the search run.

Scheduled searches using the Since search last ran option are working as designed.  Items that are not indexed cannot be found in any search.  Items for a scheduled search's date span that are indexed on the search run date will not be found in the search.

Two workarounds exist for ensuring all items needed are captured.

Workaround 1:
Run an Immediate search the day after the scheduled search with the date span of the immediate search starting on the end date of the last scheduled search and configured to not use the Include items already in review option so that only new items will be included in the search results.

Workaround 2:
Use one of the other date span options, such as Last 7 days or Last 14 days or Last 28 days, instead of the Since search last ran on a schedule that allows some overlap with the previous search, along with not using the Include items already in review option so that only new items will be included in the search results.

For example,
1.    An email having a creation date of 2019-07-10 is archived on 2019-07-10 but not indexed until 2019-07-12 which is effectively a 2 day indexing backlog.
2.    A scheduled search using the Last 7 days option and without using the Include items already in review option is set to run every 3 days with the first run of this search to be 2019-07-11.
3.    The first instance of this search would have the date span of  2019-07-04 to 2019-07-10 as scheduled searches using the Yesterday, Last 7 Days, Last 14 Days or Last 28 Days, options do not include items captured or indexed on the day of the search.
4.    As the email from 2019-07-10 was not indexed by 2019-07-11, the search would not find it.
5.    The next instance of this scheduled search would run on 2019-07-14 with a date range of 2019-07-07 to 2019-07-13.
6.    As the email was indexed on 2019-07-12 AND has its created date was indexed as 2019-07-10, it would be found by the 2nd instance of the search.