Forum Discussion
Jason E. Heiser
Dec 15, 2024Iron Contributor
Content Search: Stacking Keyword Groups
I am trying to create a Content Search for a data subject request, and I am having a really hard time building out my KQL. The issue is that I need to stack two sets of keyword searches, but the esti...
ShaunL10
Sep 21, 2026Copper Contributor
KeyQL is a pain to work with, but the example below only searches email, instant msg, and Teams and returns three hit counts — one each for White, Black and Red — showing how often each appears alongside any of Max, John or Sally. What it won't do is break that down by name: you get one figure per color, not per name-and-color pair.
(Date>=2023-01-01) AND ((Kind=email) OR (Kind=im) OR (Kind=microsoftteams)) AND (Max OR John OR Sally) AND White
(c:s)
(Date>=2023-01-01) AND ((Kind=email) OR (Kind=im) OR (Kind=microsoftteams)) AND (Max OR John OR Sally) AND Black
(c:s)
(Date>=2023-01-01) AND ((Kind=email) OR (Kind=im) OR (Kind=microsoftteams)) AND (Max OR John OR Sally) AND Red