I'm conducting an email search with a complex query using powershell, and I'm having trouble combining two conditions. I've got a list of email addresses that I want to search to/from, and a list of received dates so I'm searching for email to/from these addresses on this list of dates against a DL full of mailboxes. If I separate out the to/from search from the limiting dates, I get an appropriate number of hits. If I separate the dates from the to/from addresses, I likewise get an appropriate number of hits. However, if I try to combine the two conditions, I get nothing. It's possible that the two conditions have no overlap, but it's extremely unlikely. Has anyone had any success doing a painfully specific search using new-mailboxsearch?

Here's an example of my new-mailboxsearch (I have many more dates and to/from addresses than this):

new-mailboxsearch -Name "MySearch" -SourceMailboxes "HumanResources" -SearchQuery {"received:01/01/2017 OR received:04/01/2017 OR received 06/01/2017" -AND "FROM:hank@contoso.com OR TO:hank@contoso.com OR FROM:jill@contoso.com OR TO:jill@contoso.com"}

The -SearchQuery parameter uses the Keyword Query Language (KQL) used in SharePoint and Outlook searches. To accomplish what you want format the query to:

"(received:01/01/2017 OR received:04/01/2017 OR received 06/01/2017) AND (FROM:hank@contoso.com OR TO:hank@contoso.com OR FROM:jill@contoso.com OR TO:jill@contoso.com)"

The major difference being the first and second queries are wrapped in parenthesis and combined with the AND between them in addition to removing the brackets.

  • That did it. I knew it was something stupid like framing the query the wrong way. Thank you very much. – brian H Aug 18 '17 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.