Forum Discussion
Content Search: Stacking Keyword Groups
I've been having similar issues for a while with eDiscovery advanced logical searches. The KQL editor is very awkward and I'm quite sure possessed by a playful demon. It's when trying to AND 2 sets of keywords that I have issues. I tried to force and it removed (keyword=word) from the submitted KQL query. Trying to manually add (c:c) or (c:s) seems to be a further nightmare.
Something like the below logic where I have 1 primary keyword to be AND'd with a set of keywords that have an OR between them. Using simple query building like Word1 AND (Word2 or Word3) breaks search statistics.
Keywords=Martian
AND
(Keywords=Exchange)
(c:s) Keywords=microsoft
(c:s) keywords=powerpoint
AND
(Received=2024-10-01..2025-01-11)
FavoriteMartian "playful demon" 🤣 I often feel that we have the same issues with those playful demons.
It's great that you seem to have had success combining KQL with the auto (c:c) or (c:s). I had explicitly tried to stay away from that because one of the documents in Learn stated that it wouldn't work.
Copilot finally helped me figure out something that at least provided expected results, though I don't think I believe they're 100% accurate. I ended up having to write out different combinations of Subject: and Keyword:
For instance, this provided the best results (note I even had to break out the date component because using the standard syntax (Received=Date..Date) was returning dates outside of my range)
((Subject:"Max" OR Subject:"John" OR Subject:"Sally") OR (Keywords:"Max" OR Keywords:"John" OR Keywords:"Sally"))
AND
((Subject:White OR Keywords:White) OR (Subject:Black OR Keywords:Black) OR (Subject:Red OR Keywords:Red))
AND
((Received>=2024-06-01 AND Received<=2024-11-01))