An export performed using PowerShell cmdlet 'Export-EVArchive' results in different items as compared to results in Enterprise Vault Search (EVS) using the 'SearchString' parameter.

book

Article ID: 100047072

calendar_today

Updated On:

Cause

This issue is seen when items from an EV archive are exported using the Export-EVArchive cmdlet using the wrong "SearchString" parameter.

Resolution

1. It is required to get the accurate SearchString parameter to achieve the same search results in Export-EVArchive as on EV advanced search.

Perform the following steps to get the "SearchString" parameter:

1.    Open IIS and navigate to EV Server Name -> Sites -> Default Web Site -> EnterpriseVault.

2.    Right-click on “Search” Virtual Directory and click on Explorer.

3.    Open Web.config file in any text editor.

4.    Search for parent tag and then  sub-tag.

5.    Change the LogLevel key’s value to 4 as shown below:

4"/>

6.    Note the FilePath key’s value as shown below:

%AllUsersProfile%\Veritas\Enterprise Vault\Search\"/>

7.    Save the Web.config file now and reset IIS.

Warning: Incorrect use of Web.config may prevent the Enterprise Vault Search page from functioning properly. Great care should be taken when making changes to the Web.config file. It is recommended that a complete backup of the Search Virtual Directory be made prior to making any changes in the Web.config file. 

 

Once Enterprise Vault Indexing Service is fully functional, open EV search page and try to perform an advanced search. The search criteria provided on the EV Search page should be traced in the log file noted above (%AllUsersProfile%\Veritas\Enterprise Vault\Search\).

2. To find out SearchString, follow the steps mentioned below:

1.    Navigate to “%AllUsersProfile%\Veritas\Enterprise Vault\Search\” path on EV Server and open the latest log file available in the text editor.

2.    Search for “Submitted to SOAP API with Boolean Text Query:” text for exact SearchString provided to SOAP API.

For example: Submitted to SOAP API with Boolean Text Query: [(NOT sens:2) AND date:>2018-01-01 AND text:("test" OR "for")]

3.    Note the SearchString from the above step and apply it in Export-EVArchive as shown below and perform the export:

Export-EVArchive -ArchiveID "148CD5B24406033479632A5D1F0A9EEF51110000EValias" -OutputDirectory "\\EV01\PSTHoldingFolder" -SearchString "(NOT sens:2) AND date:>2018-01-01 AND text:(test OR for)" -Format PST -MaxPSTSizeMB 20480

Note: Remove any special character in search string as it may result in TypeCast error. (eg. Double quotes after -SearchString parameter may be considered as a start and end of SearchString parameter and remaining part will be considered as invalid extra parameters for Export-EVArchive cmdlet)

4. If a phrase is required in the SearchString it must be enclosed by quotes. The entire SearchString should then be enclosed in single quotes for PowerShell to function properly. 

Export-EVArchive -ArchiveID "148CD5B24406033479632A5D1F0A9EEF51110000EValias" -OutputDirectory "\\EV01\PSTHoldingFolder" -SearchString '(NOT sens:2) AND date:>2018-01-01 AND text:(test OR for OR "john smith")' -Format PST -MaxPSTSizeMB 20480

The ArchiveID value can be passed to Export-EVArchive from an input file if more than one archive needs to be processed.  

Import-CSV C:\Temp\Export.csv | Export-EVArchive -OutputDirectory "\\EV01\PSTHoldingFolder" -SearchString '(NOT sens:2) AND date:>2018-01-01 AND text:(test OR for OR "john smith")' -Format PST -MaxPSTSizeMB 20480

The contents of the Export.csv file should be as seen below with ArchiveID as the header and each value on a single line.  

ArchiveID 
148CD5B24406033479632A5D1F0A9EEF51110000EValias
156CD5B24406033479B5415D1F0A9EEF51110000EValias
178CD5B244060334796BD5871F0A9EEF51110000EValias

The process will then perform the same search against each archive and export the results to a unique folder under the OutputDirectory specified.  

Issue/Introduction

An export performed using PowerShell cmdlet 'Export-EVArchive' results in different items as compared to results in Enterprise Vault Search (EVS) using the 'SearchString' parameter.