Finding labeled files with Content Search

Question

I use a kql query in Content Search designed to locate files with a certain label. The query runs and I get what you see in the screenshot below. However I do not see any information regarding the actual file names and location. Pretty sure I am doing something wrong but please advise.

Answer 1

Hi @jpcapone

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

When using Kusto Query Language in Microsoft Purview for content search, it's important to ensure that your query is correctly constructed to retrieve the specific details you need, such as file names and locations.

To find labeled files using a KQL query in Content Search, ensure that you are using the correct managed properties in your query. If you are not seeing file names and locations, it may be due to the properties you are querying.

For example, when searching for documents with a specific sensitivity label, you can use the managed property InformationProtectionLabelId to filter documents by their sensitivity label.

For details, please refer: Search for documents by sensitivity label.

Content search is easy to use, but it's also a powerful tool. Behind-the-scenes, there's a lot going on. The more you know about it and understand its behavior and its limitations, the more successful you'll be using it for your organization's search and investigation needs. For more details, please refer: Learn more about content search

To effectively locate files with specific labels using Kusto Query Language (KQL) in Microsoft Purview's Content Search, you should ensure that your query captures the correct properties and that the metadata you seek (such as file names and locations) is included in the results.

Here are a few steps and considerations to help you refine your query:

Querying the Right Properties:

• Ensure your query references the correct metadata properties such as FileName, FilePath, and Label. Example query:

Label:<YourLabel> AND FileType:"docx"

• In this query: Label:<YourLabel> filters items with a specific label. FileType:"docx" ensures you're focusing on Word documents.
• For file name and location, you might want to query fields like: FileName FilePath ItemId FileType. Example query:

Label:<YourLabel> AND FileName:"*" AND FilePath:"*"

Selecting Correct Columns in Output:

• In the Content Search interface, modify the columns to include FileName, FilePath, and any other relevant metadata fields.
• To customize columns, you typically have an option like "Columns" or "Edit Columns" in the search results interface.

Ensuring Correct Application of Labels:

• Verify that the label is correctly applied to the files via Retention or Sensitivity policies in Microsoft Purview.
• If necessary, reapply labels or check the propagation of labels to ensure they are correctly indexed.

Using Advanced Query Operators:

• If you're looking for specific file metadata, you can use advanced KQL functions and operators to pull out the information you're looking for. For example, has, contains, startswith, etc., can be useful for file paths or labels.

Label:<YourLabel> AND FilePath:"/documents/*"

Troubleshooting Tips:

• Run a Broad Query to Inspect Available Fields:
  • search * | limit 10
  • This query helps identify the field names and data structure available in your dataset.
• Verify and Adjust Index/Table Names: Make sure you are querying the correct index or table that stores the metadata information you need.

For additional information, please refer: Search tips and tricks

I hope this information helps. Please do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.