Forum Discussion

ErikVet's avatar
ErikVet
Brass Contributor
May 17, 2024

KQL help Exchange Online

Hello,

I need help in buildinga KQL Query as I'm fairly new to this. I have a set of 2 keyword list like

 

Set 1 = "A","B","C"

Set 2 = "1","2","3"

 

I want a KQL Query that matches any combinations those 2 sets match. I have tried

("A" OR "B" OR "C") AND ("1" OR "2" OR "3") but that does not seem to work. 

Many Greetings
Erik 

  • FavoriteMartian's avatar
    FavoriteMartian
    Copper Contributor

    Documentation is confusing about standard query builder vs KQL editor. It seems to mix and match in the documentation. The syntax you have should be used in the standard query and it will work fine. You can nest OR AND in parenthesis logically and all is well. But one issue using this method; if you go to search statistics for the search, it will not give you a breakdown of hits per keywords.

    Microsoft has not provided a very nice way of doing AND as you want in KQL. Or at least not documented examples of such. 

Resources