Use the Process report in eDiscovery (preview)
Process report
eDiscovery (preview) includes a Process report that lists all process that count towards case process concurrency and daily limits in eDiscovery for a defined time period. eDiscovery administrators and eDiscovery Managers (preview) can access this report on the eDiscovery > Process report tab and can use this report to see the process activities across search activities and eDiscovery (preview) cases. eDiscovery Managers can view the processes usage cards at the top of the report, but the processes list is limited to the cases to which they're assigned.
Important
Processes listed on the report can't be deleted or removed. Long-running processes automatically time out after 7 days.
The process report summarizes the following key information for processes up to the last 30 days:
- All processes that are in progress or completed (successfully or with error) in a specified time range across eDiscovery areas.
- Insights into how far away your organization is from reaching process-related organization-wide limits.
- Creates a .csv report for the list of processes.
- Filters for process types, statuses, and for hours/days.
- Quick access to case/process pages by selecting case name links.
The following eDiscovery process types currently don't count towards the concurrency/daily limits and aren't shown in the report:
- Prepare for export
- Run analytics
- Tag Items
- Compare load sets
- Convert redacted items to PDF
- Prepare remediation
Note
Any processes included in the list view of the report and that have run for more than 24 hours don't contribute towards the concurrency/daily limits for your organization.
The following eDiscovery processes started in classic cases don't contribute to throttling limits and aren't reflected in the report. However, these processes started for cases in the New case format are included in the report:
- Adding non-Microsoft 365 data to a review set
- Adding remediated data to a review set
- Reindexing data
- Adding data to a review set
- Adding data to another review set
Process types and descriptions
Long-running processes are associated with specific processes that support cases and reporting in Microsoft Purview eDiscovery (preview). These processes are triggered for user actions when using and managing searches, review sets, and holds.
| Process type | Area | Description |
|---|---|---|
| Add to review | Review set | A user adds search results to a review set or adds items into the review set from another review set. The items are copied to an Azure Storage location and then those items in the Azure Storage location are reindexed. This new index is used when querying and analyzing items in the data set. |
| Applying or updating hold | Hold | A user places data sources on hold or updates a hold. |
| Export | Search Review set |
A user exports documents from a search or a review set. When the export process is complete, they can download the exported data to a local computer. |
| Generate sample | Search | After a user creates and runs a new search estimate (or reruns an existing search estimate), the search tool prepares a sample subset of items (that match the search query) that can be previewed. Previewing search results help you determine the effectiveness of the search. |
| Generate statistics | Search | After a user creates and runs or reruns a search estimate, the search tool searches the index for items that match the search query and prepares an estimate that includes the number and total size of all items by the search, and the number of data sources searched. |
| Run analytics | Search | A user analyzes data in a review set by running eDiscovery analytics tools such as near duplicate detection, email threading analysis, and themes analysis. |
| Tag | Review set | This process is triggered when a user selects Start tagging process in the Tagging panel when reviewing documents in a review set. A user can start this process after tagging documents in a review set and then bulk-selecting them in the view document panel. |
Process status
The following table describes the different status states for processes:
| Status | Description |
|---|---|
| In progress | The process is in progress, you can monitor the progress of the process in the Process manager for the area. |
| Complete | The process was successfully completed. |
| Canceled | The process was canceled by the user. |
| Abandoned | The process was automatically stopped. This stoppage may be due to excessive processing time or other reasons. |
Download report
All processes support the ability to download a packaged report. The packaged report name is Reports-caseName-EntityName-ProcessName-timestamp.zip. With EntityName being the user given name to the search or hold. Depending on the process, the report contains different .csv files.
- Summary: Tracks the time the process started, when it ended, the number of total items or locations, and the user who submitted the process request. It also contains the search query used. For Add to review set and Export from search processes, the summary report contains the summary of factors affecting the total item count added to review set or exported. The report name is Summary_the date/time of the report.csv.
- Settings: Contains the enumerated settings parameter for the process and values. The report name is Settings_the date/time of the report.
- Statistics: Contains all statistics details for the process, including all categories (if the setting was selected during process submission) such as sensitive information types, data type, and communication participants. The report name is Statistics_the date/time of the report.
- Locations: Tracks all data sources and associated locations scoped for the process. Includes the user/group entity name, location (mailbox/site URL), and count returned for that location. Also includes the status of the location (success/error and error detail). The report name is Locations_the date/time of the report.
- Items: Track all items processed, including information such as item ID, location of the item, subject/title of the item, item class/type, and success/error status. The report name is Items_the date/time of the report.
The following table shows the process types and available reports:
| Process type | Summary | Settings | Statistics | Location | Items |
|---|---|---|---|---|---|
| Add to review |  |
|
|
|
|
| Apply hold/rerun policy | |
|
|||
| Export (review set) | |
|
|
|
|
| Export (search) | |
|
|
|
|
| Generate sample | |
|
|
|
|
| Generate statistics | |
|
|
|
|
| Redact | |
|
|
||
| Tag | |
|
|||
Summary CSV report
All reporting packages contain a Summary-the date/time of the report.csv file. This file contains the following information:
Overview
The following details are included in this section of the report:
- Query: The query conditions for the applicable process types.
- StartTime: The date/time when the report generation was started.
- EndTime: The date/time when the report generation was completed.
- SubmittedBySmtp: The SMTP address for the user creating the report.
- Security filter: The status of the application of a security filter or compliance boundary.
- Region: Determines the datacenter location where searches are conducted for SharePoint sites and OneDrive accounts. It specifies the datacenter from which search results are exported during the export process.
- Roles: The roles assigned to the user creating the report.
Search results
Summary of number of items that matched your search query, including partially indexed items or items where advanced indexing was performed (depending on what setting you selected). The following details are included in this section of the report:
- Indexed items: Number of items matching the query that were natively indexed by Exchange and SharePoint.
- Partially indexed items: Number of partially indexed items that might not match the query. Included if you chose to include partially indexed items.
- AdvancedIndexedItems: Number of items matching the query if you chose to perform advanced indexing on partially indexed items.
Error
The following details are included in this section of the report:
- Retrieval exceptions: Number of items that weren't exported or added to review set due to exceptions such as empty files, access time-outs, etc.
Warning
- Items with processing errors: Number of items that experienced processing errors but were still exported or added to the review set. These errors could be caused by unsupported file types, decryption issues, etc.
Totals
The following details are included in this section of the report:
- Total items collected: Total number of items exported or added to the review set. This number factors in items from estimated results, the settings that might increase or decrease the number of items retrieved, and items that weren't collected due to errors.
Information
Note
The Information section of this report reflects how the item count can increase or decrease based on the settings you choose. The calculation process uses these settings and updates search estimate count, so the counts won't add up exactly in most cases. This information is meant to give you a sense of the changes and the reasons behind them.
The following details are included in this section of the report:
- Duplicates in review set (skipped): Items that were skipped because they already exist in the review set.
- Cloud attachments: Number of cloud attachments in email messages and Teams conversations that originated from links shared through SharePoint or OneDrive. Maps to the setting Access links(cloud attachments) in messages.
- Cloud attachments versions: Number of cloud attachment versions that were collected depending on whether you chose to include more than just the latest version in your query.
- Cloud attachments at time of sharing: Number of cloud attachments versions that represent the original version shared from SharePoint or OneDrive. This applies only to cloud attachments that have a retention label applied, which retains a copy of the file at the time of sharing.
- Contextual conversation: Number of contextual chat messages that were collected along with the message that matched your query. This indicates the number of additional messages collected before and after the message with hit. Maps to the setting "Include Teams and Viva Engage conversations". -Teams conversations consolidated into transcripts: Teams chat conversations that were converted to HTML transcript files. This results in many Teams chat message to be consolidated into a single HTML transcript. Maps to the setting "Organize conversations into HTML transcripts".
- SharePoint file versions: Number of SharePoint file versions that were collected depending on whether you chose to include more than just the latest version.
- SharePoint list items collected as .csv files: Matches from the same SharePoint list are exported or added to review set as a single SharePoint list csv item. Maps to the setting "Collect files attached to SharePoint lists and their child items."
- List attachments: Number of list attachments collected. Maps to the setting Include list attachments when collecting files attached to SharePoint lists.
- Items in SharePoint folders: Number of items expanded from SharePoint folders that matched your query. Maps to setting Collect all items (even if they don't match search query).
- Items extracted from parent items: Number of embedded or attached items that were extracted from parent items. For example, this might include attachments or embedded images from an email that matched your query.