Answered by:
KQL parser threw an exception.

Question
-
Get-mailbox Myuser@xyz.com | Search-Mailbox -SearchQuery 'Subject:"$subject" AND From:"$sender" AND Received:"$Receivedate"' -TargetMailbox "$TargetmailboxEmail" -Targetfolder "$Foldername" -LogLevel Full
While executing about cmdlet in a script block , I've been getting below error :
The KQL parser threw an exception.
+ CategoryInfo : InvalidArgument: (:) [], ParserException
+ FullyQualifiedErrorId : [Server=SRV001,RequestId=b9e9e-8248-1404da43ca27,TimeStamp=3/21/2018
4:06:02 PM] [FailureCategory=Cmdlet-ParserException] A89C8CCFCould someone , please help in correction ?
Aditya Mediratta
Wednesday, March 21, 2018 4:29 PM
Answers
-
You cannot use single quotes with embedded variables.
"Subject:'"$subject`" AND From:'"$sender`" AND Received:`"$Receivedate'""
Only $subject would require quotes because it could have spaces.
Look up and learn how to use quotations in PowerShell. Once you clearly understand how single and double quotes work the rest is easy.
Use escaped full quote inside the filter.
\_(ツ)_/
- Edited by jrv Wednesday, March 21, 2018 8:58 PM
- Proposed as answer by Albert LingMicrosoft contingent staff Thursday, March 22, 2018 2:04 AM
- Marked as answer by jrv Monday, March 18, 2019 4:10 PM
Wednesday, March 21, 2018 8:43 PM
All replies
-
I wish I had an Exchange server to try this on, but I no longer do. I'll hazard a guess that your problem lies with the use of double-quotes inside the protected string you're passing as the -SearchQuery parameter. You may need to protect those as I believe they're being removed when the script block is interpreted leaving the strings unprotected after variable interpolation.
Try something like these examples:
'Subject: ""$subject"" . . .' or 'Subject: """$subject""" . . . '
--- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)
- Proposed as answer by Albert LingMicrosoft contingent staff Thursday, March 22, 2018 2:05 AM
Wednesday, March 21, 2018 6:10 PM -
You cannot use single quotes with embedded variables.
"Subject:'"$subject`" AND From:'"$sender`" AND Received:`"$Receivedate'""
Only $subject would require quotes because it could have spaces.
Look up and learn how to use quotations in PowerShell. Once you clearly understand how single and double quotes work the rest is easy.
Use escaped full quote inside the filter.
\_(ツ)_/
- Edited by jrv Wednesday, March 21, 2018 8:58 PM
- Proposed as answer by Albert LingMicrosoft contingent staff Thursday, March 22, 2018 2:04 AM
- Marked as answer by jrv Monday, March 18, 2019 4:10 PM
Wednesday, March 21, 2018 8:43 PM -
Thanks jrv , appreciate your valuable assistance
Just modified to following & working perfectly fine now :
"Subject:$subject AND From:$sender AND Received:$Receivedate"
Aditya Mediratta
- Edited by Aditya Mediratta Thursday, March 22, 2018 11:53 AM .
Thursday, March 22, 2018 11:52 AM -
Hi,
I'm checking how the issue is going, was your issue resolved?
And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.
Appreciate for your feedback.
Best Regards,
AlbertPlease remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.comFriday, March 23, 2018 1:23 AM -
Hi
Following code fixed KQL parser exception per my query , you may mark the same for Answer for future references of folks facing similar issue :
"Subject:$subject AND From:$sender AND Received:$Receivedate"
Aditya Mediratta
Friday, March 23, 2018 4:34 AM -
Hi Aditya,
Only you (the original poster) can "mark as answers", and if there is anything else we can do for you, please feel free to post in the forum.
Best Regards,
AlbertPlease remember to mark the replies as an answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.comFriday, March 23, 2018 6:58 AM -
jrv,
I'm posting my tested syntax for the -SearchQuery parameter, as some of your escape characters look like single quotes for some reason, and because in my case I needed to account for spaces in the Sent: portion of the query, because I was using the data as it was pulled from O365 by a PCI scanning tool as a CSV file. (My timestamp format was 12/31/2018T13:21:55.000-07:00 and Search-Mailbox reads this just fine once you replace the capital T with a space. I'll assume that the Received: parameter of Search-Mailbox can read such a timestamp as well.)
Anyway, here's the syntax I used. I didn't take any chances, and enclosed in quotes the From: and To: same as all the rest.
-SearchQuery "Subject:`"$subj`" AND Sent:`"$sent`" AND From:`"$from`" AND To:`"$to`""
- Proposed as answer by Daniel Schultz Wednesday, February 6, 2019 2:08 AM
Tuesday, February 5, 2019 5:49 AM -
Here is a much easier and safer way to do this:
$sq = 'Subject:"{0}" ANDSent:"{1}" AND From:"{2}"AND To:"{3}"' -f $subject, $sent, $from, $to -SearchQuery $sq
It eliminates issues with quotes and impossible to see escape characters.
\_(ツ)_/
- Proposed as answer by Daniel Schultz Wednesday, February 6, 2019 2:08 AM
Tuesday, February 5, 2019 7:15 AM -
Very elegant solution! I've made note of it.Wednesday, February 6, 2019 2:08 AM
-
This was excellent! Is there a way to utilize your method and implement a date range under 'Sent'? I tried this, but didn't work: $sq = 'From:"{0}" AND Sent:"{1}"' -f $Sender, $StartDate..$EndDateFriday, March 15, 2019 9:33 PM
-
This was excellent! Is there a way to utilize your method and implement a date range under 'Sent'? I tried this, but didn't work: $sq = 'From:"{0}" AND Sent:"{1}"' -f $Sender, $StartDate..$EndDate
You need to learn how to use the string formatter operator "-f".
See: help about_operators
\_(ツ)_/
Friday, March 15, 2019 9:44 PM