Slack data source

This topic provides details on how to capture Slack data with Collect.

Considerations

Review the list of considerations before starting your collection:

  • We recommend limiting the volume and number of custodians per job. Limiting both will reduce the collection time and reduce the chance of errors.
  • Slack data is collected in grouped collections and will have a different data count than the other standard collections. Grouped collections are a set of RSMFs containing all the chats for the custodians assigned to the collection. Since the data is grouped together, the expected behavior for custodian targets to have the same count.
    Essentially if you are collecting two or more custodian targets in this scenario, the total number of items for each of them will match because the number is counting the sum of all the chats for all of them combined.
  • We recommend limiting the date range of the collection. Extended date ranges can increase collection time and potentially create issues.
  • We do not recommend collecting each custodian separately, with one collection collecting one custodian target. This creates duplicate chats in cases where the custodians have been chatting with each other. This makes the collection harder to manage and account for in review and would take much longer.

Slack application setup

Before using the Slack data source in Collect, you must create and authorize Collect as an application within Slack.

There are specific steps to connect Slack to Relativity when creating the data source. To set up the Slack data source, you need to enable API access with Slack and then complete the data source settings in Relativity.

For more information, see Relativity Collect: Collecting from a Slack Enterprise Data Source training video.

Your Slack organization must be on:

  • Enterprise Grid plan—The Collect application requires the Enterprise Grid plan that provides access to the Discovery API. For more information, see Slack's documentation.
  • GovSlack—You will need a Slack FedRamp account. For more information, see Slack's GovSlack documentation.

Before Slack can be set up as a Collect data source, the Slack organization owner needs to email exports@slack.com to gain Discovery API access. Follow the instructions on the Enabling an Organization window.

Enabling an organization window.

Once Slack confirms your Discovery APIs are enabled for your organization, proceed to set up your Slack data source in Relativity.

Creating the data source in Collect

After confirming that your Discover APIs are enabled, complete the set up process in RelativityOne to connect the Slack data source to Collect

Note: You set up data source connections at a workspace level. You only need to set up a given data source connection once in a given workspace. For example, if you have three different workspaces to run collections in, you would need to set up the Slack data source connection three times, once for each workspace. If all collections are from just one workspace, then you only need to set up the data source once.

In RelativityOne:

  1. Navigate to Collection Admin within Collect Admin of Set Up.
  2. Click the New Collection Source Instance button.
    • Name—enter in a unique name for the data source.
    • Type—select the Slack data source.
  1. Click Install Application. After clicking the Install Application, a window from Slack appears. You must disable pop-ups in your browser to see the window.
      Notes:
    • If you already logged in, you will see a window with an Allow button to authorize the Collect application. If you did not log in, you must log in as the organization owner. Make sure you enter the organization URL when signing in.
      If you logged into multiple organizations, make sure to select the correct one in the drop-down menu in the top-right corner. If you do not know your organization URL, you can find it in the Overview section of About This Workspace in Slack.
    • Add an organization to the drop-down menu by opening a new window outside of this workflow and sign into another organization. Another option is to log out of the current organization before clicking Install Application and logging in when requested.
  1. Click the Allow button.
    Sample screen with Allow button
  1. After clicking Allow, navigate in the same window to a page where you will copy a temporary token.
  2. Click Copy Temporary Code to copy to your clipboard.
    Temporary Code Instructions screen with Copy Temporary Code button.
  1. Once copied, you can close that window and return to RelativityOne.
  2. In Collect, paste the code in the Temporary Code field.
  3. Click Generate Access Token.The access token will be generated and populated in the Access Token field below.
    Notes: Paste this token in the Access Token field in any other additional workspaces you want to setup.
  1. Click Save.

Settings fields

To connect Relativity to the Slack data source, you need to gather and enter the information for the following fields. Setting up Slack includes steps outside of Collect. To get the steps to gather the temporary code and access token, see Slack application setup.

  • Temporary Code—enter the code provided by Slack after installing application. The Generate Slack Access token section provides steps to retrieve the Temporary Code and Access Token.
  • Access Token—enter the application token retrieved after authorizing Relativity as an application in Slack. For more information, see Slack documentation.

Configuring the data source in Collect

Each data source used in Collect has different search criteria on the Collection Details step when creating a collection job. The criteria needs to be configured next.

  1. Configure search criteria to collect specific data.
    • Select and unselected tabs—choose the data sources to collect from by moving unselected data sources to the selected list.
    • Field—choose the field to filter on within the data source.

        Notes: This field is only required when you select a calendar source.
    • Operator—choose an operator such as equals, contains, greater than, or less than.
    • Value—enter a value to find in the selected field.
  2. Click Add Criteria. Each criteria is separated by an AND operator.

The following table lists the filter criteria supported for Slack collections. Slack collections require you to enter the start date and end data criteria. Slack puts a limit on how far back you can run a collection. Your organization's Slack enterprise retention policy sets this time period. For more information, see Slack documentation.

Note: You need to register Relativity in Slack before using this data source. For information on registering Relativity in Slack, see Slack documentation.

When using the Slack data source:

  • You can collect Archived Slack channels.
  • You cannot collect deleted Slack channels.
  • Relativity collects Slack data in Relativity Short Message Format (RSMF). For more information, see The Relativity Short Message Format .
  • RSMF has a 2 GB processing limit. For more information, see Processing an RSMF file.
Criteria Field Operators Description Example
Channel Name Equals When you use the Channel Name property, the search returns all message within the channels that equals the search word or phrase in the channel's name.

If you use the Channel Name property in a query, the search returns all messages that the channel name equals the text you’re searching for. In other words, the query does not return only those messages from channels that have an exact match. For example, if you search for subject “finance_team,” your results include messages from channels like "finance_team_project.”
Conversation Type Equals When you use the Conversation Type property in a query, the search returns all messages that were either in a direct message or group message. If you use the Group Message conversation type in a query, the search results returns messages that exist in group messages. Direct, one-on-one messages will not be included in the collection.
End Date Less Than Or Equals When you use the End Date property in a query, the search returns all messages the day of and before the entered date.

If you search a Start Date of 1/1/2001 and an End Date of 1/1/2020, the search returns all messages on and between the two dates.

We recommend limiting the date range to maintain a high performance level and a lower collection time.
Slice Interval in Hours Equals When you use The Slice Interval in Hours property, the search returns all messages in a specific time range or defaults the slice interval to 24 hours. If you search with a slice interval set to one hour and a conversation spans five hours, you will end up with five RSMFs after processing. For more information, see RSMF Slicing.
Start Date Greater Than Or Equals When you use the Start Date property in a query, the search returns messages that exist the day of and after the entered date.

If you search a Start Date of 1/1/2001 and an End Date of 1/1/2020, the search returns all messages on and between the two dates.

We recommend limiting the date range to maintain a high performance level and a lower collection time.
Workspace Name Equals

When you use the Workspace Name property, the search returns all messages in all channels within the workspace that equals the search word or phrase in the workspace's name

 If you use the Workspace Name property in a query, the search returns all messages that the instance name equals the text you’re searching for. For example, if you search for subject “Company A,” your results include messages from that instance.

If a Slack channel with same name exists across multiple Slack workspaces within a collection, Collect will collect all content in both channels in both workspaces.

You can collect Direct Messages, Group Messages, or both Direct and Group messages. Do not select a conversation type if you want to collect all messages.

The Slice Interval in Hours criteria defaults the slice interval to 24 hours. This means Collect will create one file for the conversations within that 24-hour interval. If the conversation goes beyond 24 hours, a second Relativity Short Message File (RSMF) will be created. Another example is if you have a slice interval set to one hour and a conversation spans five hours, you will end up with five RSMFs after processing.

Collections include deleted messages. Relativity displays deleted messages on the day the user deleted the message, not the day the user sent the message. Also, Relativity collects only the message when a deleted message includes an attachment. Files sent as attachments without a message and then deleted, the metadata is available for 24 hours, but the file is not collected. When Relativity collects deleted messages in threads, Relativity displays the messages outside of the thread in the RSMF.

Relativity collects conversations in public or private channels for each day in the date range regardless if the custodian participated in that channel on a given day.

When collecting multiple custodians' data, and each custodian is in the same channel, Relativity collects the channel once.