Home
Join

4 Replies

  • Hey michaelmcclelland2​, so I'm no expert at this but from what I'm gathering right now how to do eDiscovery searches, the number in the ONEAR refers to words and not spaces... so not sure if that is the effect you are looking for.

    So Blah* ONEAR (5) Blarg* could score a hit with "Blahsenstein the quick brown fox Blargenwurfers"
    Also, it's redundant to make ONEAR (4...2) ... ONEAR(5) means return any matches to Keyword 1 that occur afterwards and within (5) five words.
    So 1)  "Blahsenstein Blargenwurfers" or any progressively larger set up to ""Blahsenstein the quick brown fox  Blargenwurfers" would match.
    Also 2) if "Blargenwurfers" came first... there would be no match - ONEAR is set off by the first term, then it looks for the second.

    3) What type of documents/files are you searching?
    Email? SharePoint or OneDrive files? Just note that can also make a difference in some cases (no pun intended).
    Apparently ONEAR operator isn’t supported when searching mailboxes.
    Here are some of the articles I've referenced...
    Office 365 Security & Compliance Center eDiscovery – Part 3: Phrases and Grouping AND OR’ing (Oh, my!)  -  https://www.undocumented-features.com/2020/04/02/office-365-security-compliance-center-ediscovery-pa...
    Hope this helps, and good luck!
     Let us know more details, perhaps we can provide better help, or someone else that knows this better than me can guide you. Cheers!
    Was this post helpful? thumb_up thumb_down
  • any update? how did it go?

    Was this post helpful? thumb_up thumb_down
  • We bungled our way through it and finally got it figured out, i think there were about a dozen different iterations of the search terms.  

    It was a learning experience for sure!

    Spice (1) flagReport
    Was this post helpful? thumb_up thumb_down
  • yeah, it looked kinda hairy once I looked at all the options... cra cra like NEAR vs ONEAR etc

    glad you got it sorted.

    Spice (1) flagReport
    Was this post helpful? thumb_up thumb_down

Read these next...

  • What laptop(s) to buy for workplaces?

    What laptop(s) to buy for workplaces?

    Hardware

    Hi everyone,At a customer they are looking for new laptops for certain workplaces.There are 2 variants involved:- Basic laptops, to perform very light tasks (internetting, e-mail, Excel/Word).- Laptops for management, these need to be a bit faster, but ar...

  • The SOC Briefing for July 1st - Summer here we go

    The SOC Briefing for July 1st - Summer here we go

    Security

    Good morning and welcome to today's briefing. Apologies for not posting last week, the weekend got ahead of me and didn't have time to post. But today we have a lot of updates from various vendors including Microsoft, QNAP (seems to be a lot here) and the...

  • Snap! SessionManager malware, Chrome pwds, PowerShell, moon base, Starlink, etc

    Snap! SessionManager malware, Chrome pwds, PowerShell, moon base, Starlink, etc

    Spiceworks Originals

    Your daily dose of tech news, in brief. While it feels almost like another lifetime, I do recall when music wasn't available on my phone to listen to. But even before that, there was a time when music on the go was not readily available. But, on Ju...

  • Spark! Pro series – 1st July 2022

    Spark! Pro series – 1st July 2022

    Spiceworks Originals

    I didn’t have a Walkman at least not until they came out with the CD version.  Nope, I had a knock off made by a company named Craig.  But, that Craig, played hours and hours of music.  I believe it still worked...

  • Change DNS zone to AD integrated

    Change DNS zone to AD integrated

    Networking

    I have a client who is running a single server 2008 that is the DC and File Server. We just added a new server 22 to replace the old server. It joined to domain fine and promoted it to dc but noticed that DNS was not replicating even though everything els...