Slack data source

This topic provides details on how to capture Slack with Collect.

Considerations

Review the list of considerations before starting your collection:

We recommend limiting the volume and number of custodians per job. Limiting both will reduce the collection time and reduce the chance of errors.
Slack data is collected in grouped collections and will have a different data count than the other standard collections. Grouped collections are a set of RSMFs containing all the chats for the custodians assigned to the collection. Since the data is grouped together, the expected behavior for custodian targets to have the same count.
Essentially if you are collecting two or more custodian targets in this scenario, the total number of items for each of them will match because the number is counting the sum of all the chats for all of them combined.
We recommend limiting the date range of the collection. Extended date ranges can increase collection time and potentially create issues.
We do not recommend collecting each custodian separately, with one collection collecting one custodian target. This creates duplicate chats in cases where the custodians have been chatting with each other. This makes the collection harder to manage and account for in review and would take much longer.

Slack application setup

Before using the Slack data source in Collect, you must create and authorize Collect as an application in Slack.

There are specific steps to connect Slack to Relativity when creating the data source. To set up the Slack data source, you will need to enable API access with Slack and then complete the data source settings in Relativity.

For more information, see Relativity Collect: Collecting from a Slack Enterprise Data Source training video.

Your Slack organization must be on:

Enterprise Grid plan. The Collect application requires the Enterprise Grid plan that provides access to the Discovery API. For more information, see Slack's documentation.
GovSlack. You will need a Slack FedRamp account. For more information, see Slack's GovSlack documentation.

Before Slack can be set up as a Collect data source, the Slack organization owner needs to email exports@slack.com to gain API access, see the details below.

Once Slack confirms your Discovery APIs are enabled for your organization, proceed to set up your Slack data source in Relativity.

Creating the data source

After confirming that your Discover APIs are enabled, complete the set up process in Relativity.

Note: You set up data source connections at a workspace level. You only need to set up a given data source connection once in a given workspace. For example, if you have three different workspaces to run collections in, you would need to set up the Slack data source connection three times, once for each workspace. If all collections are from just one workspace, then you only need to set up the data source once.

In RelativityOne, use the following procedure to connect the Slack data source to Collect:

Click the New Collection Source Instance button.
Enter in a unique name for the data source.
Select the Slack data source. Either Slack commercial or Slack government.
Click Install Application.
After clicking the Install Application, a window from Slack appears. You must disable pop-ups in your browser to see the window.
In the window, click Allow button.
After clicking Allow you will navigate in the same window to a page where you will copy a temporary token.
Click Copy Temporary Code to copy to your clipboard.

Once copied, you can close that window and return back to RelativityOne.
In Collect, paste the code in the Temporary Code field.
Click Generate Access Token.

The access token will be generated and populated in the Access Token field below.
Click Save.

Settings fields

To connect Relativity to the Slack data source, you need to gather and enter the information for the following fields. Setting up Slack includes steps outside of Collect. To get the steps to gather the temporary code and access token, see Slack application setup.

Temporary Code—enter the code provided by Slack after installing application. The Generate Slack Access token section provides steps to retrieve the Temporary Code and Access Token.
Access Token—enter the application token retrieved after authorizing Relativity as an application in Slack. For more information, see Slack documentation.

Configuring the data source

Configure the data sources chosen in the Collection Details step. If you select multiple data sources in the first step, you'll configure all sources in the step. Switch between each source by clicking the name of the data source in the left navigation menu. Clicking Next and Previous also moves you through the data sources. Select individual data sources by clicking on the checkbox and then using the right arrows to select them. After selecting the data sources to configure, fill out the criteria. Each data source has different criteria to enter.

Add search criteria to collect specific data. To configure the data sources, complete the following fields:

Select and unselected tabs—choose the data sources to collect from by moving unselected data sources to the selected list.
Field—choose the field to filter on within the data source.
Operator—choose an operator such as equals, contains, greater than, or less than.
Value—enter a value to find in the selected field.

The following table lists the filter criteria supported for Slack collections. Slack collections require you to enter the start date and end data criteria. Slack puts a limit on how far back you can run a collection. Your organization's Slack enterprise retention policy sets this time period. For more information, see Slack documentation.

Note: You need to register Relativity in Slack before using this data source. For information on registering Relativity in Slack, see Slack documentation.

When using the Slack data source:

You can collect Archived Slack channels. You cannot collect deleted Slack channels.
Relativity collects Slack data in Relativity Short Message Format (RSMF). For more information, see The Relativity Short Message Format .
RSMF has a 2 GB processing limit. For more information, see Processing an RSMF file.

Criteria Field	Operators	Description	Example
Channel Name	Equals	When you use the Channel Name property, the search returns all message within the channels that equals the search word or phrase in the channel's name.	If you use the Channel Name property in a query, the search returns all messages that the channel name equals the text you’re searching for. In other words, the query does not return only those messages from channels that have an exact match. For example, if you search for subject “finance_team,” your results include messages from channels like "finance_team_project.”
Conversation Type	Equals	When you use the Conversation Type property in a query, the search returns all messages that were either in a direct message or group message.	If you use the Group Message conversation type in a query, the search results returns messages that exist in group messages. Direct, one-on-one messages will not be included in the collection.
End Date	Less Than Or Equals	When you use the End Date property in a query, the search returns all messages the day of and before the entered date.	If you search a Start Date of 1/1/2001 and an End Date of 1/1/2020, the search returns all messages on and between the two dates. We recommend limiting the date range to maintain a high performance level and a lower collection time.
Slice Interval in Hours	Equals	When you use The Slice Interval in Hours property, the search returns all messages in a specific time range or defaults the slice interval to 24 hours.	If you search with a slice interval set to one hour and a conversation spans five hours, you will end up with five RSMFs after processing. For more information, see RSMF Slicing.
Start Date	Greater Than Or Equals	When you use the Start Date property in a query, the search returns messages that exist the day of and after the entered date.	If you search a Start Date of 1/1/2001 and an End Date of 1/1/2020, the search returns all messages on and between the two dates. We recommend limiting the date range to maintain a high performance level and a lower collection time.
Workspace Name	Equals	When you use the Workspace Name property, the search returns all messages in all channels within the workspace that equals the search word or phrase in the workspace's name	If you use the Workspace Name property in a query, the search returns all messages that the instance name equals the text you’re searching for. For example, if you search for subject “Company A,” your results include messages from that instance.

If a Slack channel with same name exists across multiple Slack workspaces within a collection, Collect will collect all content in both channels in both workspaces.

You can collect Direct Messages, Group Messages, or both Direct and Group messages. Do not select a conversation type if you want to collect all messages.

The Slice Interval in Hours criteria defaults the slice interval to 24 hours. This means Collect will create one file for the conversations within that 24-hour interval. If the conversation goes beyond 24 hours, a second Relativity Short Message File (RSMF) will be created. Another example is if you have a slice interval set to one hour and a conversation spans five hours, you will end up with five RSMFs after processing.

Collections include deleted messages. Relativity displays deleted messages on the day the user deleted the message, not the day the user sent the message. Also, Relativity collects only the message when a deleted message includes an attachment. Files sent as attachments without a message and then deleted, the metadata is available for 24 hours, but the file is not collected. When Relativity collects deleted messages in threads, Relativity displays the messages outside of the thread in the RSMF.

Relativity collects conversations in public or private channels for each day in the date range regardless if the custodian participated in that channel on a given day.

When collecting multiple custodians' data, and each custodian is in the same channel, Relativity collects the channel once.