Frodo_Baggins Posted October 11, 2022 Posted October 11, 2022 Running a SAR but have a few domains and would like to limit the domains that are searched e.g. only emails sent\received by users with an @Middleearth email address but also includes the words "The One Ring" in the subject\body? Current search un-restricted is 340GB - Anyone have experience with the KQL editor? Tried the below as keywords (Might have to open in new tab as the image looks really small for some reason...) Cheers!
psydii Posted October 12, 2022 Posted October 12, 2022 ((ParticipantDomains="middleearth") AND (Subject:"The One Ring")) The KQL query builder is our friend. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now