Thanks in advance for reading & any help you can provide!
I'm trying to do a mailbox search against several mailboxes. I need to find all messages that mention some words AND don't mention other words EXCEPT when those words are on both lists. This is a complex search. I don't know how to twist the Keyword Query Language logic to accomplish this.
I recognize the search command will be complex and take a long time to run. That's fine.
Example:
Search for items that mention Teddy.
I want items that mention Roosevelt.
I want items that mention mugwump
I want items that mention Rough Riders
I don't want anything that mentions Franklin Roosevelt.
BUT if a message mentions both Teddy and Franklin, I need that.
I don't want anything with "new-deal" in the subject
I don't want anything that mentions Truman.
I want to include wildcards.
Searching for "Roosevelt" will definitely bring in "Franklin." I can't unilaterally exclude "Franklin" without missing some "Teddy"
My current query:
New-MailboxSearch -SearchQuery "Teddy* OR mugwump* OR Roosevelt* OR 'Rough Riders*' NOT ((Franklin* NOT Teddy*) OR Truman* OR subject:'new-deal')"
Ran the above search. Received 9,500 hits. I found some e-mails with "mugwump" and "franklin pierce". Something's not right here.
Back when I ran "Teddy* OR Roosevelt*" I received 10,000 hits.
When I ran "Teddy* OR Roosevelt* NOT (Franklin* NOT Teddy*)" I received 9,500 hits. So I thought it worked?
In case it was a parenthetical issue, I also tried "(Teddy* OR Roosevelt*) NOT (Franklin* NOT Teddy*)". I still received 9,500 hits.
Bracketing the positive search terms didn't make a difference.
I then tried "(Teddy* OR Roosevelt*) NOT (Franklin*) I still received 9,500 hits. There were Franklin's in the results so something is really off here.
Is it a quotation problem? I can't find clear documentation on single quotes ' ' vs double quotes " ", vis-à-vis how they affect search operators and parentheses.
Microsoft's KQL documentation doesn't mention it. Most of the Google hits for KQL are for Sharepoint, which has a different bent (and options) compared to Exchange. A number of Exchange hits are actually for AQS.
I haven't found good examples of a complex KQL query like mine with nested search terms....
I tried swapping all of the single quotes with double quotes. It brought my results down to 4,000. It was just an -EstimateOnly, I haven't had a chance to run the actual job and inspect the results.
1. Will the "NOT (Franklin* NOT Teddy*) double-negative trip over itself?
2. Is there another way to say, "include this, unless it also includes that" ?
3. Is there a better way of arranging the parentheticals?
4. Am I doing something wrong with my quotations?
Thanks for your help!