Clone a Content Search

Creating a Content Search in the Microsoft Purview compliance portal in Microsoft 365 that searches many mailboxes or SharePoint and OneDrive for Business sites can take a while. Specifying the sites to search can also be prone to errors if you mistype a URL. To avoid these issues, you can use the Windows PowerShell script in this article to quickly clone an existing Content Search. When you clone a search, a new search (with a different name) is created that contains the same properties (such as the content locations and the search query) as the original search. Then you can edit the new search by changing the keyword query or the date range, and run it.

Why clone Content Searches?

• To compare the results of different keyword search queries run on the same content locations.

• To save you from having to reenter a large number of content locations when you create a new search.

• To decrease the size of the search results. For example, if you have a search that returns too many results to export, you can clone the search and then add a search condition based on a date range to reduce the number of search results.

Script information

• You need to install the Exchange Online PowerShell module. For instructions, see Install and maintain the Exchange Online PowerShell module.

• You have to be a member of the eDiscovery Manager role group in the Microsoft Purview compliance portal to run the script described in this topic.

• The script includes minimal error handling. The primary purpose of the script is to quickly clone a content search.

• The script creates a new Content Search, but doesn't start it.

• This script takes into account whether the Content Search that you're cloning is associated with an eDiscovery case. If the search is associated with a case, the new search will also be associated with the same case. If the existing search isn't associated with a case, the new search will be listed on the Content search page in the Microsoft Purview compliance portal.

• The sample script provided in this topic isn't supported under any Microsoft standard support program or service. The sample script is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample script and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.

Step 1: Run the script to clone a search

The script in this step will create a new Content Search by cloning an existing one. When you run this script, you'll be prompted for the following information:

• Your user credentials - The script will use your credentials to connect to Security & Compliance PowerShell. As previously stated, you have to be a member of the eDiscovery Manager role group in the Microsoft Purview compliance portal to run the script.

• The name of the existing search - This is the Content Search that you want to clone.

• The name of the new search that will be created - If you leave this value blank, the script will create a name for the new search that is based on the name of the search that you're cloning.

To clone a search:

1. Save the following text to a Windows PowerShell script file by using a filename suffix of .ps1; for example, CloneSearch.ps1.

   # This PowerShell script clones an existing content search in Microsoft Purview compliance.
   
   # Ask for the name of the search you want to clone
   $searchName = Read-Host 'Enter the name of the search that you want to clone'
   # Ask for the name of the new search
   $newSearchName = Read-Host 'Enter a name for the new search [leave blank to automatically generate a name]'
   $originalSearch = Get-ComplianceSearch $searchName -EA SilentlyContinue
   # Make sure we have a valid search before continuing
   if(!$originalSearch)
   {
       Write-Error "Couldn't find search: $searchName"
       return
   }
   $searchNameCounter = 1
   # Find a suitable name for the new search
   while(!$newSearchName)
   {
       $newSearchName = $originalSearch.Name + "_" + $searchNameCounter
       $tempSearch = Get-ComplianceSearch $newSearchName -EA SilentlyContinue
       if ($tempSearch)
       {
           $newSearchName = $null
           $searchNameCounter++
       }
   }
   $caseName
   # Determine if the search is part of a case; if so get the case name
   if ($originalSearch.CaseId)
   {
       $searchCase = Get-ComplianceCase $originalSearch.CaseId
       $caseName = $searchCase.Name
   }
   # Need to cast this value as a Boolean the old fashion way
   $allowNotFoundExchangeLocationsEnabled = $false
   if ($originalSearch.AllowNotFoundExchangeLocationsEnabled)
   {
       $allowNotFoundExchangeLocationsEnabled = $true
   }
   $newSearch = New-ComplianceSearch -Name $newSearchName -AllowNotFoundExchangeLocationsEnabled $allowNotFoundExchangeLocationsEnabled -Case $caseName -ContentMatchQuery $originalSearch.ContentMatchQuery -Description $originalSearch.Description -ExchangeLocation $originalSearch.ExchangeLocation -ExchangeLocationExclusion $originalSearch.ExchangeLocationExclusion -Language $originalSearch.Language -SharePointLocation $originalSearch.SharePointLocation -SharePointLocationExclusion $originalSearch.SharePointLocationExclusion -PublicFolderLocation $originalSearch.PublicFolderLocation
   if ($newSearch)
   {
       Write-Host $newSearch.Name "was successfully created" -ForegroundColor Yellow
   }
   

2. Connect to Security & Compliance PowerShell. In the same PowerShell window, go to the folder where you saved the script.

3. Run the script; for example:

   .\CloneSearch.ps1
   

4. Enter following information when prompted by the script. Type each piece of information and then press Enter.

   • The name of the existing search.
   • The name of the new search.

   The script creates the new Content Search, but doesn't start it. This gives you a chance to edit and run the search in the next step. You can view the properties of the new search by running the Get-ComplianceSearch cmdlet or by going to the Content search or eDiscovery page in the Microsoft Purview compliance portal, depending on whether the new search is associated with a case.

Step 2: Edit and run the cloned search in the Microsoft Purview compliance portal

After you run the script to clone an existing Content Search, the next step is to go to the Microsoft Purview compliance portal to edit and run the new search. As previously stated, you can edit a search by changing the keyword search query and adding or removing search conditions. For more information, see:

• Content Search in Office 365

• Keyword queries and search conditions for Content Search

• eDiscovery cases