Powershell – Exchange 2013 new-mailboxsearch searchquery combining two conditions

exchange-2013powershell

I'm conducting an email search with a complex query using powershell, and I'm having trouble combining two conditions. I've got a list of email addresses that I want to search to/from, and a list of received dates so I'm searching for email to/from these addresses on this list of dates against a DL full of mailboxes. If I separate out the to/from search from the limiting dates, I get an appropriate number of hits. If I separate the dates from the to/from addresses, I likewise get an appropriate number of hits. However, if I try to combine the two conditions, I get nothing. It's possible that the two conditions have no overlap, but it's extremely unlikely. Has anyone had any success doing a painfully specific search using new-mailboxsearch?

Here's an example of my new-mailboxsearch (I have many more dates and to/from addresses than this):

new-mailboxsearch -Name "MySearch" -SourceMailboxes "HumanResources" -SearchQuery {"received:01/01/2017 OR received:04/01/2017 OR received 06/01/2017" -AND "FROM:hank@contoso.com OR TO:hank@contoso.com OR FROM:jill@contoso.com OR TO:jill@contoso.com"}

Best Answer

The -SearchQuery parameter uses the Keyword Query Language (KQL) used in SharePoint and Outlook searches. To accomplish what you want format the query to:

"(received:01/01/2017 OR received:04/01/2017 OR received 06/01/2017) AND (FROM:hank@contoso.com OR TO:hank@contoso.com OR FROM:jill@contoso.com OR TO:jill@contoso.com)"

The major difference being the first and second queries are wrapped in parenthesis and combined with the AND between them in addition to removing the brackets.