SOLVED

Content Search vs Search on an eDiscovery Case

%3CLINGO-SUB%20id%3D%22lingo-sub-57419%22%20slang%3D%22en-US%22%3EContent%20Search%20vs%20Search%20on%20an%20eDiscovery%20Case%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-57419%22%20slang%3D%22en-US%22%3E%3CP%3ETesting%20out%20Search%20%26amp%3B%20Investigation%20within%20the%20Security%20%26amp%3B%20Compliance%20Admin%20Center.%20%26nbsp%3BWhat's%20the%20difference%20between%20performing%20a%20'Content%20Search'%20on%20a%20specific%20mailbox%20vs%20utilizing%20the%20Search%20within%20an%20eDiscovery%20case%20on%20a%20specific%20mailbox%3F%20%26nbsp%3BI%20ran%20a%20search%20both%20ways%20on%20one%20specific%20mailbox%20and%20the%20returned%20results%20were%20drastically%20different%20(30%2C000%20results%20in%20Content%20Search%20and%20only%205%2C000%20in%20search%20within%20eDiscovery).%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-331564%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20vs%20Search%20on%20an%20eDiscovery%20Case%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-331564%22%20slang%3D%22en-US%22%3EOne%20difference%20that%20I%20can%20think%20off%20from%20my%20experience%20is%20the%20ability%20to%20put%20content%20on%20hold.%20While%20eDiscovery%20search%20allows%20you%20to%20put%20content%20on%20hold%20a%20mere%20content%20search%20wont%20allow%20you%20to%20do%20that.%20Under%20the%20hood%20both%20searches%20should%20provide%20same%20results.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-134322%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20vs%20Search%20on%20an%20eDiscovery%20Case%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-134322%22%20slang%3D%22en-US%22%3E%3CP%3EErin%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDid%20you%20have%20a%20response%20about%20this%20%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERegards.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-58146%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20vs%20Search%20on%20an%20eDiscovery%20Case%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-58146%22%20slang%3D%22en-US%22%3E%3CP%3EDo%20share%20back%20once%20you%20get%20a%20proper%20answer%20from%20support!%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-57796%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20vs%20Search%20on%20an%20eDiscovery%20Case%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-57796%22%20slang%3D%22en-US%22%3E%3CP%3EThanks.%20There's%20definitely%20messages%20missing%20when%20I%20look%20at%20the%20results.%20%26nbsp%3BI'll%20try%20a%20support%20ticket.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-57704%22%20slang%3D%22en-US%22%3ERe%3A%20Content%20Search%20vs%20Search%20on%20an%20eDiscovery%20Case%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-57704%22%20slang%3D%22en-US%22%3E%3CP%3EShould%20be%20the%20same%2C%20underneath%20they%20both%20use%20the%20same%20cmdlet.%20And%20it's%20easy%20to%20confirm%20that%20if%20you%20just%20provide%20the%20same%20name%20for%20the%20search.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20just%20run%20a%20search%20using%20both%20methods%20against%20my%20own%20mailbox%2C%20and%20the%20results%20are%20the%20same.%20The%20differences%20you%20see%20might%20be%20because%20of%20additional%20items%20(mailboxes%2C%20sites%2C%20PFs%2C%20groups)%20included%20in%20the%20search%2C%20or%20due%20to%20the%20way%20Previewing%20of%20search%20results%20is%20handled.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Contributor

Testing out Search & Investigation within the Security & Compliance Admin Center.  What's the difference between performing a 'Content Search' on a specific mailbox vs utilizing the Search within an eDiscovery case on a specific mailbox?  I ran a search both ways on one specific mailbox and the returned results were drastically different (30,000 results in Content Search and only 5,000 in search within eDiscovery).

5 Replies

Should be the same, underneath they both use the same cmdlet. And it's easy to confirm that if you just provide the same name for the search.

 

I just run a search using both methods against my own mailbox, and the results are the same. The differences you see might be because of additional items (mailboxes, sites, PFs, groups) included in the search, or due to the way Previewing of search results is handled.

Thanks. There's definitely messages missing when I look at the results.  I'll try a support ticket.

best response confirmed by Deleted
Solution

Do share back once you get a proper answer from support! :)

Erin,

 

Did you have a response about this ?

 

Regards.

One difference that I can think off from my experience is the ability to put content on hold. While eDiscovery search allows you to put content on hold a mere content search wont allow you to do that. Under the hood both searches should provide same results.