Purview Audit search SharePoint online returns 0 when searching for a string in a document

Question

My dear friends, I use a developer tenant which has E5 developer licenses.

I do a purview audit search and I want to search for the word dakota in a SPO site, in libraries.

All I did was pressing this button to enable the search

I use site admin account to do the search, but to be on the save side I made a new role named Admin, assigned it to my account with all roles attached.

See my search settings below

Nnothing is found

I have several word documents in this site in SPO libraries where the word is listed.

When I search for listitemcreated I get some results, so its working a bit

I expect this search after a string in SPO returning 0 is the route cause of a problem I have with an auto labeling policy which is finding 0 also when I am looking for the string dakota in the same site.

Answer 1

Dear Noel Hofman,

Thank you for posting your query in our community.

I understand your concern and would like to convey that According to my test

Please enter Dakota Star (*) in the keyword and try whether it works or not. however, if that doesn't work you can also try entering Dakota Star (*) in the folder or site. Leave the keyword blank. Then from there, it will show a list of results regarding to this keyword. Then you can you can download the results and filter the results to show this site when only.

Appreciate your patience and understanding. Have a great day!

Yours sincerely,

Answer 2

Hi, I tried a few more options, all returns 0.

Here a word doc in this SPO site with the word dakota in it

Answer 3

Dear Noel Hofman,

Thank you for the details provided. From your picture, we noticed "dakota" is a word in the content of a document. We would like to convey that this type of data content could not be used in "keyword" area based on this article Search the audit log | Microsoft Learn. Based on our testing, it supports "file name phrases" and some other indexed content. To get searching result on your side, we suggest you enter the document name with "*". For example, the file name is "test document for sharepoint online", you can enter "test*" or "test document*".

Click inside of the searching result, you can see the file information.

At the same time, we completely understand that it would be much better if it supports "data content" auditing. Thank you for bringing up this great idea. I would suggest you creating an entry in the feedback portal so you can let your voice be heard. Here is the link. Community (microsoft.com) Let's expect this function in the future.

Appreciate your patience and understanding. Have a great day!

Yours sincerely,

Answer 4

I changed the file name of a document in the SPO library and added the word dakota

new search and result still 0

Answer 5

Dear Noel Hofman,

May I know when did you perform the name changing and when did you perform the audit search? It normally takes some time (around 24 hours) for new name being indexed. In addition, SharePoint searching is using "prefix + *" for searching.

Keyword Query Language (KQL) syntax reference | Microsoft Learn Therefore, we would suggest you 1) Kindly change the name to be "Dakota Document". 2) Please wait for 24 hours and search again with the same condition "Dakota*". Then please check if it can be returned in audit log.

Appreciate your patience and understanding. Have a great day!

Yours sincerely,