Forum Discussion
eDiscovery KeyQL
I am hoping someone might be able to help me with some KeyQL syntax. I want to find documents that contain a combination of SITs with a minimum occurrence of 1 and a confidence level of between 85 - 100%. I have used the following syntax which shows no errors before I run the query. I have tested the first Sensitive type using the condition builder and it returns matches but even if I try the first line of KeyQL on it's own nothing is returned. Could anyone help please
SensitiveType:“50b8b56b-4ef8-44c2-a924-03374f5831ce” |1..|85..100 - Microsoft built in SIT "All Full Names"
AND SensitiveType:“accaf4c2-fb54-40f7-aea8-db0e36a2e9eb” |1..|85..100 - Custom SIT "DOB"
AND SensitiveType:“8B9E5FBC-4AA9-4017-8256-BE3E8241AEB5” |1..|85..100 - Microsoft built in SIT "U.K. Physical Address"
Thanks
Chris
1 Reply
Prathista IlangoMicrosoft
Hello chrishorsted720,
When I chose the condition from condition builder and selected Sensitive Type: All Full names, the equivalent KQL shown was: ((SensitiveType=“50b8b56b-4ef8-44c2-a924-03374f5831ce”))
Please try the following,
- Try running the KQL: ((SensitiveType=“50b8b56b-4ef8-44c2-a924-03374f5831ce”)) and see if you are seeing expected results.
- If yes, try running the same with the confidence level.
- Also try using the condition builder to select multiple sensitive types and run. Please be sure of what operator to use (AND/OR).
- If step 2 works, use the KQL from the condition builder from Step 3, modify with confidence level for all three similar to step 2 and run.
Also, make sure the same data sources are selected when you run with condition builder and KQL.
Please let us know if it works.
Please mark as solution, if you find the answer helpful. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided