Query Syntaxes

Exchange 2010 used a subset of Advanced Query Syntax (AQS) in discovery searches such as those performed by the Search-Mailbox cmdlet for example. AQS was also shared with other Windows search components such as Windows Desktop Search.

Since Exchange 2013, that AQS has been replaced by Keyword Query Language, or KQL for short. KQL is shared with other Office 2013 and 2016 applications, with the most important one being SharePoint 2013/2016. Exchange and SharePoint can, together, form a single discovery domain across emails stored in Exchange and documents in SharePoint, making it crucial for a single and unified query syntax that can be used across both platforms.

This appendix provides additional information related to working with KQL when performing queries with Exchange Search.

The following Exchange Management Shell cmdlets provide a -SearchQuery parameter...

Using the word phrase search

The following table outlines some of the properties that can be used to define a KQL query using a word phrase restriction:

Property	Examples	Description
Attachments	attachment:report.xlsx attachment:salesreport.docx attachment:pptx attachment:* hasattachment=yes hasattachment:true	This searches for items that have an attachment with a specific name, such as report.xlsx, or salesreport.docx. You can include partial filenames, as shown in the third example, to find all attachments with a certain extension. The last three examples find all messages that have an attachment.
Bcc	Bcc:Bob Bcc:Bob Smith	This searches for items where Bob was included in the blind carbon copy line.
Body	Body:financial Content:financial	This searches for items where the word financial appears in the message body.
Category	Category:&apos...

Using a date range search

The following table outlines the properties that can be used to define a KQL query using a date range restriction:

You can use relative dates when performing a date range restricted search. For example, today, tomorrow, or yesterday can be used with the Received or Sent keywords.

You can use a specific day of the week: (Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, or Saturday) with the Received or Sent keywords.

You can also use a specific month: (January, February, March, April, May, June, July, August, September, October, November, or December) with the Received or Sent keywords.

Examples

If you want to delete all messages in the administrator mailbox that were received today, use the...

Using the message type search

The following table outlines the properties that can be used to define a KQL query using a message type restriction:

Examples

If you want to delete all contacts from a mailbox, use the following command:

    Search-Mailbox administrator '
    -SearchQuery "Kind:Contacts" '
    -DeleteContent -Force  

If you want to delete all the notes from a mailbox, use the following code:

    Search-Mailbox administrator '
    -SearchQuery "Kind:Notes" '
    -DeleteContent -Force  

Using search operators

The following table outlines the Boolean search operators that can be used to define a KQL query using a logical connector between two keywords:

Connector	Example	Description
AND	Subject:sales AND Subject:report Subject:(sales AND report)	These examples search for items with both sales and report in the subject line
OR	Subject:sales OR Subject:report Subject:(sales OR report)	These examples search for items with the word sales or report in the subject line
NOT	NOT Body:sales Body:(NOT sales)	These examples search for items without the word sales in the body

Examples

If you want to delete meeting items that have specific content in the body, such as the phrase Social...