Search management

Nuix Investigate provides a form-assisted search toolbar that allows you to search within your data to find items of interest quickly. From the toolbar, a search can be constructed freeform using a combination of keywords or assembled in pieces within the query staging area using search filters and other search techniques.

The search toolbar can be minimized and maximized using the close and open form-assisted search icons that are located below the toolbar.

The top Search bar consists of:

Previous Query – Click to re-run the previous query from search history. This action can be repeated to step back through each query in the history until the first query is reached. At that time, the action is switched off until a new search is performed.

Keyword Search Box – Enter keywords or a valid Nuix search query.

Query Builder – Expand to create a query using Nuix Query Language (NQL) via the Query Builder.

Date Filter – Filter items by date. See the Date Search section.

Hide Immaterial Items – Select to exclude immaterial items (enabled by default). See the Immaterial Items section.

Preview Query – Click to view or copy the current generated query including all applied filters, formatted as NQL.

Save Query – Click to save the current search. See the Saved Searches section.

Search – Click to initiate the search.

Reset – Click to remove any applied search filter pills and clear the search results returned from a query. If there is a saved default search, the default search pills are restored. If there is no default search, the original default pills are restored.

The bottom Search bar consists of:

Clear Query – Click to remove all search filter pills. The currently applied search query and result set are not affected. The All pill appears as an indicator that the staged query is blank. If you click Search when the All pill is displayed, it returns all items in the case (that are available to the user).

Deduplication Indicator – Indicates if the results of the current query are being deduplicated. This icon only appears when there are items to be deduplicated. Deduplication can be turned on in the Query Builder. The Item Deduplication filter, if applied to a query, is not included when copying the query to the clipboard.

Note: Deduplication in Query Builder is not recommended because it can be very time intensive.

Search Pills – Shows each pill in the query as you build it. As a query is defined, Nuix Investigate encapsulates and displays the search criteria within a search pill in the query staging area. See the Stage a Query section.

To cancel a search that is currently in progress, click Cancel below the running search’s progress bar.

Search history

To view a list of previously run queries, click within the keyword search box prior to entering a search to view search history. Search history is maintained for each user within a case and persists across browsers.

Note: Search queries larger than 0.1MB are not saved in search history due to database restrictions.

The search history view expands below the search box to display the most recently run queries and the amount of time that has elapsed since the query was last run. When the history view expands, each query appears with an icon that represents how the query was initiated. Queries can be run in the following ways:

 

The history view also displays a Deduplication icon if the results were deduplicated.

To close the history view, click anywhere outside of the view, or enter a query into the search box.

The history view is only accessible when the search box is empty. To quickly clear a query from the search box, click the Clear Query icon within the search field. Performing this action clears the text from the search box. The currently applied search query and result set are not affected. The All pill indicates that the staged query is blank. If you click Search when the All pill is displayed, it returns all items in the case (that are available to the user).

Stage a query

The query staging area is a section within the form-assisted search bar that allows users to easily visualize and manage a query before running it against the case. Every query starts with the default pills of Hide Immaterial and Not Excluded. As a query is defined, Nuix Investigate encapsulates and displays the search criteria within a search pill in the query staging area. If the search criteria are applied from multiple filters, each filter is added as a separate search pill separated by a logical AND or OR operator. The AND operator is applied by default.

Once criteria are defined, use the query staging area to review your query, remove or modify individual filters, or change the logical operator applied between pills. Click Reset to revert to the default search criteria.

The search criteria contained within a search pill can be modified at any time with the following actions:

Click on a pill to open or move focus to the search function that contributed the criterion so modifications can be made.

Note: Depending on the search function that generated the search criteria, some pills cannot not be modified once added to the query staging area. When this occurs, the pill must be removed and created again with the correct criteria.

Click the X within the pill to remove it from the query.

Note: If you manually remove every pill, the All pill appears as an indicator that the staged query is blank. If you click Search when the All pill is displayed, it returns all items in the case (that are available to the user).

Click the logical operator between two pills to toggle it between AND | OR.

Depending on the state of a query, search pills are presented with the following outlines.

Once the query is finalized, click Search to run the query.

‎