Forum Discussion

Chuck33's avatar
Chuck33
Copper Contributor
May 06, 2023

eDiscovery KQL assistance

I feel like this should be easier than it is. I am searching for all material relating to a topic. I want get the material in two parts, one with everything except the "privileged" material and the other with everything else. I created the searches with KQL below, the idea was the results of searches 2 and 3 should equal the results of search 1. This has not been my outcome. Search 1 and Search 2 appear to return the same results and search 3 returns nothing. I believe I need to adjust the syntax of one or more of these searches but i dont seem to be able to get it right.

Search 1 - All the results
Content:"Target"

 


Search 2 - Only the results that include "Privileged" material (specific To/From values and Target)


Content:"Target" AND (To:'@domain1.com' OR To:'@domain2.com' OR To:'@domain3.com' OR To:'@domain4.com' OR To:'@domain5.com' OR To:'@domain6.com' OR To:'@domain7.com' OR From:'@domain1.com' OR From:'@domain2.com' OR From:'@domain3.com' OR From:'@domain4.com' OR From:'@domain5.com' OR From:'@domain6.com' OR From:'@domain7.com') AND (Content:"Person One" OR Content:"Person Two" OR Content:"Person Three" OR Content:"Person Four" OR Content:"Person five" OR Content:"Person six" OR Content:"Person Seven" OR Content:"Person Eight" OR Content:"Person ten" OR Content:"Person eleven")  

 


Search 3 - Only the results that do not include "Privileged" material (specific To/From values and Target)


Content:"Target" AND NOT (To:'@domain1.com' OR To:'@domain2.com' OR To:'@domain3.com' OR To:'@domain4.com' OR To:'@domain5.com' OR To:'@domain6.com' OR To:'@domain7.com' OR From:'@domain1.com' OR From:'@domain2.com' OR From:'@domain3.com' OR From:'@domain4.com' OR From:'@domain5.com' OR From:'@domain6.com' OR From:'@domain7.com') AND NOT (Content:"Person One" OR Content:"Person Two" OR Content:"Person Three" OR Content:"Person Four" OR Content:"Person five" OR Content:"Person six" OR Content:"Person Seven" OR Content:"Person Eight" OR Content:"Person ten" OR Content:"Person eleven")  

No RepliesBe the first to reply

Resources