Exchange 2013 new-mailboxsearch searchquery combining two conditions

I'm conducting an email search with a complex query using powershell, and I'm having trouble combining two conditions. I've got a list of email addresses that I want to search to/from, and a list of received dates so I'm searching for email to/from these addresses on this list of dates against a DL full of mailboxes. If I separate out the to/from search from the limiting dates, I get an appropriate number of hits. If I separate the dates from the to/from addresses, I likewise get an appropriate number of hits. However, if I try to combine the two conditions, I get nothing. It's possible that the two conditions have no overlap, but it's extremely unlikely. Has anyone had any success doing a painfully specific search using new-mailboxsearch?

Here's an example of my new-mailboxsearch (I have many more dates and to/from addresses than this):

new-mailboxsearch -Name "MySearch" -SourceMailboxes "HumanResources" -SearchQuery {"received:01/01/2017 OR received:04/01/2017 OR received 06/01/2017" -AND "FROM:hank@contoso.com OR TO:hank@contoso.com OR FROM:jill@contoso.com OR TO:jill@contoso.com"}
0
задан 18 August 2017 в 18:14
1 ответ

Параметр -SearchQuery использует язык запросов по ключевым словам (KQL) , используемый при поиске в SharePoint и Outlook. Чтобы выполнить желаемое, отформатируйте запрос так:

"(received:01/01/2017 OR received:04/01/2017 OR received 06/01/2017) AND (FROM:hank@contoso.com OR TO:hank@contoso.com OR FROM:jill@contoso.com OR TO:jill@contoso.com)"

Основное различие состоит в том, что первый и второй запросы заключены в круглые скобки и объединены с помощью AND между ними в дополнение к удалению скобок.

0
ответ дан 5 December 2019 в 07:31

Теги

Похожие вопросы