AdamS Posted February 20, 2018 Report Share Posted February 20, 2018 I have a functional question which I'm hoping to get answered. I'm curious as to the need for re-indexing when creating custom columns. As with all things that seem simple in my mind I'm sure there is a reason for it, but this question could possibly morph into a feature request depending on how it is accomplished. My basic understanding of Intella is that the indexing process creates a database file which has pretty much all the information we see in displayed nicely in the GUI. Every piece of readable data has already been included in the database, so when we are creating custom columns there is no new information introduced to the database, we are creating a new link or relationship. How this question has arisen for me is for a colleague who wanted to change the naming convention when exporting some items to a universal date, so for today rather than the Australian version of 20/02/2018 he wants 20180220. This can't be accomplished with the current naming options as they are based on the columns available. I can't make any changes to the date/time format in preferences as they are all based on Country. Is it possible within the framework of Intella to have custom columns run on some sort of background 'refresh' rather than a full index? Or alternatively how about the ability to define custom columns before indexing? Quote Link to comment Share on other sites More sharing options...
AdamS Posted February 20, 2018 Author Report Share Posted February 20, 2018 Okay, played around a bit and have half answered my own question and thought I'd share....then ask another question. I can create custom columns prior to indexing by simply cancelling the 'add source' window that automatically opens up when created a new case. The only catch here is that you need to have prior knowledge of the fields you wish to draw data from. For example what I was trying to achieve with the dates above can be done by creating a custom column that draws from the 'PR_CLIENT_SUBMIT_TIME' field, then manipulating the way dates are displayed. Okay, so far so good. The first issue is that the field 'PR_CLIENT_SUBMIT_TIME' doesn't appear in every email, so it's clear that intella when determining the sent/received dates of emails draws this data from a number of different places, which requires some foreknowledge of all the possible fields which contain sent/received information. At a quick check on this current data source of have the following in relation to 'sent' times PR_CLIENT_SUBMIT_TIME PR_MESSAGE_DELIVERY_TIME 0x0f02 0x0f0a PR_CREATION_TIME OriginalModTime RouteTimes This source has a mix of PST and NSF archives. I'm looking at creating a number of templates which can be imported prior to indexing, but to be effective I need an exhaustive list of the fields within RAW data and what the field is displaying. So my new question, presumably you (Intella) have one, but I'm also assuming this is IP which you painstakingly compiled yourselves. Is there a source somewhere you could point me which contains this data? Quote Link to comment Share on other sites More sharing options...
AdamS Posted February 21, 2018 Author Report Share Posted February 21, 2018 So I ran a re-index on a case with two custom columns and neither have worked as expected, xml data from one is below. Have I missed something? I did alter the way the date presented when compiling the settings but the preview was showing as expected. <?xml version="1.0" encoding="UTF-8" standalone="true"?> -<customColumnConfiguration> <version>1</version> -<column> <id>16001</id> <name>Uni Date SENT</name> <type>LocalDate</type> <description>Universal Date Format</description> <inUse>false</inUse> -<rule> <sourceField>0x0f0a</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>PR_CLIENT_SUBMIT_TIME</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>PR_CREATION_TIME</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>OriginalModTime</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> <joinTextValues>false</joinTextValues> <separator> </separator> </column> -<column> <id>16002</id> <name>Uni Date RECEIVED</name> <type>LocalDate</type> <description>Universal Date Format</description> <inUse>false</inUse> -<rule> <sourceField>DeliveredDate</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>PR_MESSAGE_DELIVERY_TIME</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> -<rule> <sourceField>0x0f02</sourceField> <sourceFieldType>RawData</sourceFieldType> <dateFormat>yyyyMMdd HH:mm:ss z</dateFormat> <dateFormatLangTag>en-AU</dateFormatLangTag> <mediaType>special/any</mediaType> </rule> <joinTextValues>false</joinTextValues> <separator> </separator> </column> </customColumnConfiguration> Quote Link to comment Share on other sites More sharing options...
igor_r Posted February 21, 2018 Report Share Posted February 21, 2018 Hi Adam, I'm curious as to the need for re-indexing when creating custom columns. Is it possible within the framework of Intella to have custom columns run on some sort of background 'refresh' rather than a full index? This is a limitation of the current version. In a future version it will be possible to refresh the custom columns only without re-indexing the entire case. So my new question, presumably you (Intella) have one, but I'm also assuming this is IP which you painstakingly compiled yourselves. Is there a source somewhere you could point me which contains this data? Intella uses the following fields: 1. PR_CREATION_TIME 2. PR_LAST_MODIFICATION_TIME 3. PR_CLIENT_SUBMIT_TIME - Sent 4. PR_MESSAGE_DELIVERY_TIME - Received Additionally Intella uses date fields from email headers. You can find more information about Outlook fields on MSDN web site: https://msdn.microsoft.com/en-us/library/. Just try searching for a specific field. So I ran a re-index on a case with two custom columns and neither have worked as expected, xml data from one is below. Have I missed something? I did alter the way the date presented when compiling the settings but the preview was showing as expected. I tried to repeat your test and it worked fine for me. I think you used incorrect date format settings. Here is what I used: From: Raw Data Field: PR_CLIENT_SUBMIT_TIME Date Format: EEE MMM dd HH:mm:ss zzz yyyy Can you try that? If it still doesn't work, can you check the exception report? It should contain a detailed error message. Quote Link to comment Share on other sites More sharing options...
AdamS Posted February 22, 2018 Author Report Share Posted February 22, 2018 Thanks Igor, I will try that new date format today and see if it works. Although when I was altering the time/date format the preview section was displaying correctly which led me to think I'd got it right. Possibly something else I did that I can't recall, but in any case I will try your format and see how that goes. Edit: okay just looking at the date format you have suggested this will give me (according to the preview) 'Thu Feb 22 09:22:15 AWST 2018' However, the format I'm looking for here is '20180222 09:22:15 AWST' so I will use YYYYMMdd HH:mm:ss zzz' which shows in the preview as '20180222 09:24:21 AWST' which is exactly what we need. The reason for this format is that we can throw together many different documents from different sources and easily sort chronologically. Previously I used something slightly different which didn't work but I'll try again and see what happens. Quote Link to comment Share on other sites More sharing options...
AdamS Posted February 22, 2018 Author Report Share Posted February 22, 2018 So re-indexing with my preferred view failed, I'm attempting again with your suggested format Igor, although even if successful will not produce the data in the format required. Once this process is finished I'll forward the exception report. Quote Link to comment Share on other sites More sharing options...
AdamS Posted February 22, 2018 Author Report Share Posted February 22, 2018 (edited) It's definitely something to do with the syntax I'm using to try and get the date displayed how we need. I ran the re-index again with the 'Sent' date in the format you suggested Igor and left another column in the format I want for received items. The Sent column has worked and is displaying the date/time however the other is not displaying anything. Below is an excerpt of the exceptions report, all items with my syntax show the exact same error. 9 a67394d757442b3adf698ea3646434da Email Archives 89037 Email Message Email Archives/eDiscovery Request 01-09.06.2017-1304PM.pst/Top of Personal Folders Meta data Unprocessable data Could not parse date/time: Wed Sep 06 13:04:08 AWST 2017. Column: Uni Date RECEIVED Igor did you try with my syntax? I'm going to try on another data source to see if it's unique to this data set. And can now confirm still have the same issues on a different data source. Doesn't like my syntax even though the preview shows it working. Edited February 22, 2018 by AdamS Quote Link to comment Share on other sites More sharing options...
igor_r Posted February 28, 2018 Report Share Posted February 28, 2018 Hi Adam, As you can see from the exception report, the value Wed Sep 06 13:04:08 AWST 2017 does not correspond to the date format you specified in the custom column YYYYMMdd HH:mm:ss zzz. So Intella doesn't know how to parse it. Please note that the Date Format option tells Intella how to parse the value, not how to display it. If you want to change the way how date values are formatted in the details table and previewer, then it can only be done via Preferences -> Display and Locale -> Date format -> Select regional standard. Did you try to use load file export? As I said earlier it allows to set a custom date/time format. You can choose CSV format and uncheck natives, images and texts, so it will be just one CSV file in the end. Quote Link to comment Share on other sites More sharing options...
AdamS Posted February 28, 2018 Author Report Share Posted February 28, 2018 I may have strayed from the original goal here, the end goal was to be able to export files and have this date type used as a file name. This would allow us to export files from different cases/custodians, have them all in the same folder and sort chronologically instantly based on the file name. The only way I could see to accomplish this easily was to create a custom column which we could then use as the file name when exporting the files. You mention that the format setting is only telling Intella how to Parse the data, my confusion is stemming from the fact that the preview window is showing the data displayed in the format that I am wanting, see pic. In terms of changing preferences the only options listed are all based on Countries, so I'm not able to accomplish the desired effect there. At the moment we are using Bulkrename software to accomplish what we need, and to be fair it doesn't add too much time on to the task, I just thought there might be an easier way to accomplish this. It would seem a logical step to me to have Intella be able to display dates in a format that we choose for custom columns, this will give some flexibility to have alternate date/time formats shown without having to effect case wide changes under the preferences. Quote Link to comment Share on other sites More sharing options...
igor_r Posted March 6, 2018 Report Share Posted March 6, 2018 Hi Adam, Thanks for clarification. An option for setting a custom date format is certainly on our list. It will be added in one of the future versions. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.