Configuring Slack Indexing

NetGovern eDiscoverycases can include data sourced directly from Slack Enterprise. Indexing and Archiving jobs must be set up to process the data and make the Slack content available in NetGovern Search. To index Slack files, posts, and replies, you must create a Slack Index job in the NetGovern Admin UI.

IMPORTANT
Indexing must be performed prior to archiving in order to make the archived content searchable—see Configuring Slack Archiving.

The Slack Index agent will crawl files, posts, and replies across direct chats, group chats, and workspace channels. When indexed, the Slack Enterprise data becomes available and searchable in a NetGovern Search case—see IM Searches.

IMPORTANT
While NetGovern supports both Slack Enterprise and Slack Plus, only Slack Enterprise can be indexed.
NOTE
It is not necessary to create a policy in NetGovern to guide this job.
  • Log into the NetGovern Admin UI.
  • Go to Archiving > Agents > IM Indexing. Click Create.

  • Select Slack Enterprise from the Source Type drop-down menu.
  • Give the indexing job a meaningful name and click Create.
  • The newly created job appears in the navigation tree. Click on it.

  • Navigate to the Criteria tab to begin configuration tasks.

  • Navigate to the Source section. In the Crawler field, use Find to identify the Slack Indexing Location you previously created—see Configuring Slack Connectors.
    Click OK.
  • Set Incremental Indexing to only index data that has not been indexed since the last time an index job was run on the data in question. It relies on the timestamp of a previously finished index job. Leaving Incremental Indexing unselected will ensure that all content is indexed from the very beginning, unless you make a date selection in the following step.

  • Select Options:
  • Index posts from last X days: Select this to specify the data range for new Slack content to index.
  • TIP
    It is a best practice to use this option for a initial index job, then let the indexing run on Incremental Indexing on a Continuous schedule.
  • NOTE
    If you previously selected Incremental Indexing, this would index only new posts created in the date range specified that have not already been indexed. If you previously left Incremental Indexing unselected, all posts created in the specified date range will be indexed, regardless of previous index jobs.
  • Index posts content contain: Set the scope of the data indexed. To specify the content indexed, enter your input using Regex.
  • Under Workspace Selection you can choose various options:
  • Index posts from all the workspaces, channels. This indexes all workspaces and channels associated with the Slack location selected earlier.
  • Index posts only from the following workspaces, channels. Select the workspace(s) and/or channel(s) affected. If you select this option you cannot select the following one.
  • Exclude posts from the following workspaces, channels. Select the workspace(s) and/or channel(s) affected. If you select this option, you cannot select the option above.

  • Click Save.
  • In the Job Settings tab, enter a Description. You can enter the name of the index job.
  • Set the appropriate Job Priority. You can choose between Low, Normal, and High. By default, the Priority is Normal.
  • NOTE
    This setting is useful in scenarios where multiple jobs are running concurrently and you want to control which job takes priority with respect to thread allocation. The job priority you select determines which job in the queue is selected next by the JobManager process, which is responsible for allocating queued job threads to available thread slots on the archive nodes. Prioritization is categorized according to user account. For example, you may want to assign higher priority to crawling files created by VIP users. If a normal priority job is already running and using all available job threads, setting the priority to high and executing it will direct any freed threads to be used on the new high-priority job. This feature works in conjunction with load balancing in order to control crawling job distribution.
  • Select the Mode:
  • Continuous: Indexes operate on a continual basis without interruption. The index keeps up to date with all changes in the location.
  • Pause: Stops indexing. Once the initial index is built, there is no need to continue running it.
  • Pause and delete indexes: Stops indexing and deletes the existing index. Then, it re-indexes once, and pauses.

  • Select the Users. To archive all user accounts, leave All users from location enabled.
  • To specify the accounts that will be archived, disable the option All users from location and click Select to find the users to include.

  • To list users by ID Filter, enter the User ID Filter or click List Users to list all.
  • To list users by SSV file, select List users from SSV file and ensure the correct SSV file path is entered.
  • Once listed, you can select the users and click Add. When moved to the right-hand display, the users are included.

  • Click Save.

  • Logging provides you with detailed job logs that can assist with job troubleshooting, if needed. In the Log Settings tab, configure the desired log settings:
  • Disable Detailed Logging (Default): Deactivates logging.
  • Enable Logging: Activates logging for troubleshooting purposes.
  • Enable Logging Only for the Next Run: Activates logging the next time the job is run, and then automatically returns logging to ‘disabled’ state.
  • You can also have email Notifications sent at the completion of the Slack Index job, along with attachment options.

  • For further information on logging—see Configuring Logging.
  • In the Report tab, check on the progress of the Slack Index job.
    For further information on reports—see Viewing Reports.
  • To archive the Slack data and search the archived Slack content—see Configuring Slack Archiving.