For example, returns any message sent to that the property being searched is greater than the specified value. The colon (:) in the property:value syntax specifies that the property value being searched for equals the specified value. If no number is specified, the default distance is eight words. For example, best NEAR(5) worst returns messages where the word 'worst' is within five words of 'best'. Returns messages with words that are near each other, where n equals the number of words apart. This query returns items that contain keyword1 and excludes items that contain keyword2. For example, NOT from:'Ann Beebe' excludes messages sent by Ann Beebe. Keyword1 NOT keyword2 NOT from:'Ann Beebe'Įxcludes messages specified by a keyword or a property: value expression. Returns messages that include one or more of the specified keywords or property: value expressions. This query would be equivalent to 'keyword1 + keyword2' and return items with the exact phase 'keyword1 + keyword2'. The query keyword1 + keyword2 (with a space after the + symbol) isn't the same as using the AND operator. Therefore, this example is equivalent to the query (keyword2 OR keyword3) AND keyword1. Returns items that contain either keyword2 or keyword3 and that also contain keyword1. Returns messages that include all of the specified keywords or property: value expressions. The following table lists the operators that you can use to narrow or broaden search results. ), quotation marks, parentheses, and wildcards, help you refine eDiscovery search queries. Other techniques, such as using property operators (such as >= or. Supported search operatorsīoolean search operators, such as AND, OR, and NOT, help you define more-precise mailbox searches by including or excluding specific words in the search query. For example, you can use annb, or 'Ann Beebe' to specify the user Ann Beebe. The second example returns all messages that contain the word northwind in the subject line.Īll examples return messages where Ann Beebe is specified in the To: line.ġ For the value of a recipient property, you can use the SMTP address, display name, or alias to specify a user. Messages that contain the exact phrase 'Quarterly Financials' anywhere in the text of the subject line.

Subject:'Quarterly Financials' subject: northwind The text in the subject line of an email message. The second example returns messages from 1 through 1,048,576 bytes (1 MB) in size. The date that an email message was received by a recipient. Messages sent by or sent to The second example returns all messages sent by or sent to a user in the domain. The second example returns email messages, instant messaging conversations, and voice messages that meet the search criteria.Īll the people fields in an email message these fields are From, To, CC, and BCC. Kind: email kind: email OR kind:im OR kind:voicemailĮmail messages that meet the search criteria. Messages that are marked as high importance, medium importance, or low importance. Importance: high importance: medium importance: low By default, messages are sent with normal importance, unless the sender sets the importance as high or low. The importance of an email message, which a sender can specify when sending a message. Messages sent by the specified user or sent from a specified domain. In both examples, messages with Pilar Pinilla specified in the CC field. Messages that have been assigned the red category in the source mailboxes.

Categories can be defined by users by using Outlook or Outlook on the web (formerly known as Outlook Web App). In the second example, using the wildcard returns messages with the word 'annual' in the file name of an attachment.Īll examples return messages with Pilar Pinilla included in the Bcc field. Messages that have an attached file with a name matching annualreport.ppt, for example, 'annualreport.ppt' or '2017 annualreport.ppt'. The names of files attached to an email message.Īttachment: annualreport.ppt attachment: annual* The table includes an example of the property:value syntax for each property and a description of the search results returned by the examples. The following table lists email message properties that can be searched using an In-Place eDiscovery search or by using the New-MailboxSearch or the Set-MailboxSearch cmdlet. For more information, see Keyword Query Language syntax reference. In-Place eDiscovery uses Keyword Query Language (KQL). The topic also describes Boolean search operators and other search query techniques that you can use to refine eDiscovery search results. This topic describes the properties of Exchange email messages that you can search by using In-Place eDiscovery & Hold in Exchange Server 2016 or Exchange Server 2019.

Boolean search query