Search Query help - Condition Card Builder - KQL?

Question

I'm trying to get a proper search done by the IT department. I have been told that they use condition card builder and Kusto query language.

I need to search for “wordA” near 5 words of “wordB” (either before or after)

They say they can't do it, but I can in other programs.

I was told that 'around' means 'and' That there was no 'near'command 'W/5' wasn't a search command

Is there a command to do my search? I have other issues with the database administrator, such as I gave a list of people who the emails should be from and the results were not from the individuals, but they were CC in the message.

Answer 1

The query

(wordA NEAR(5) wordB)(senderauthor=fromemailaddress)

can be copied and pasted into the keyword section of the condition card builder.

Connect, build and run the search in PowerShell:

connect-ippssession

new-compliancesearch -name "Near Search" -description "search using NEAR" -exchangelocation mailbox@domain.com -contentmatchquery '(wordA NEAR(5) wordB)(senderauthor=fromemailaddress)'

start-compliancesearch "NEAR Search"

mailbox@domain.com is the mailbox to search - it can also be a distribution list (which will search all member mailboxes).