Security Compliance content search

I need to search the body of email for specific word(s). I have created searches but do not see Body as an option when adding conditions.

Thanks
agcsupportAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
You should be able to use Subject as both keyword and/or condition. How did you create the search? Have you reviewed the documentation, there are multiple examples on how you can use a Subject-based query: https://support.office.com/en-us/article/keyword-queries-and-search-conditions-for-content-search-c4639c2e-7223-4302-8e0d-b6e10f1c3be3#emailproperties
0
agcsupportAuthor Commented:
@Vasil - I need to search the body of the email not the subject. Message Body is not an option when creating the search.

Content Search\New Search\Add Condition
0
Vasil Michev (MVP)Commented:
Well, that's what you wrote above:

I have created searches but do not see Subject as an option when adding conditions.

Anyway, the "body" keyword is no longer supported with the new syntax, you can however "exclude" other parts of the message by using the NOT operator. For example:

"bla bla keywords bla bla" NOT subject:"Project X"

Or you can do the same with conditions, which allow you to use the "subject does not equal" clause.
0
agcsupportAuthor Commented:
You are correct and I have edited the question.

Seems ridiculous that one cannot search the body of an email for a keyword. Why on earth would they allow you to search every other field than the one that contains the most content of an email. Hmmm maybe I just answered my own question. Maybe they don't want to run queries against a field that contains so much data.
0
Vasil Michev (MVP)Commented:
Because the new experience in the SCC is focused on more than just email, it covers all workloads now. Thus workload-specific keywords are not always supported. You can always go back to the EAC and run eDiscovery query with the "body" keyword from there, or even use Search-Mailbox.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Office

From novice to tech pro — start learning today.