locked
KQL parser threw an exception. RRS feed

  • Question

  • Get-mailbox Myuser@xyz.com | Search-Mailbox -SearchQuery 'Subject:"$subject" AND From:"$sender" AND Received:"$Receivedate"' -TargetMailbox "$TargetmailboxEmail" -Targetfolder "$Foldername" -LogLevel Full

     While executing about cmdlet in a script block , I've been getting below error :

    The KQL parser threw an exception.

        + CategoryInfo          : InvalidArgument: (:) [], ParserException
        + FullyQualifiedErrorId : [Server=SRV001,RequestId=b9e9e-8248-1404da43ca27,TimeStamp=3/21/2018
        4:06:02 PM] [FailureCategory=Cmdlet-ParserException] A89C8CCF

    Could someone , please help in correction ?


    Aditya Mediratta

    Wednesday, March 21, 2018 4:29 PM

Answers

  • You cannot use single quotes with embedded variables.

    "Subject:'"$subject`" AND From:'"$sender`" AND Received:`"$Receivedate'""

    Only $subject would require quotes because it could have spaces.

    Look up and learn how to use quotations in PowerShell.  Once you clearly understand how single and double quotes work the rest is easy.

    Use escaped full quote inside the filter.


    \_(ツ)_/



    Wednesday, March 21, 2018 8:43 PM

All replies

  • I wish I had an Exchange server to try this on, but I no longer do. I'll hazard a guess that your problem lies with the use of double-quotes inside the protected string you're passing as the -SearchQuery parameter. You may need to protect those as I believe they're being removed when the script block is interpreted leaving the strings unprotected after variable interpolation.

    Try something like these examples:

    'Subject: ""$subject"" . . .' or 'Subject: """$subject""" . . . '


    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)

    Wednesday, March 21, 2018 6:10 PM
  • You cannot use single quotes with embedded variables.

    "Subject:'"$subject`" AND From:'"$sender`" AND Received:`"$Receivedate'""

    Only $subject would require quotes because it could have spaces.

    Look up and learn how to use quotations in PowerShell.  Once you clearly understand how single and double quotes work the rest is easy.

    Use escaped full quote inside the filter.


    \_(ツ)_/



    Wednesday, March 21, 2018 8:43 PM
  • Thanks jrv , appreciate your valuable assistance 

    Just modified to following & working perfectly fine now :

     "Subject:$subject AND From:$sender AND Received:$Receivedate"



    Aditya Mediratta


    Thursday, March 22, 2018 11:52 AM
  • Hi,

    I'm checking how the issue is going, was your issue resolved?

    And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.

    Appreciate for your feedback.

    Best Regards,
    Albert

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, March 23, 2018 1:23 AM
  • Hi 

    Albert Ling,

    Following code fixed KQL parser exception per my query , you may mark the same for Answer for future references of folks facing similar issue :

     "Subject:$subject AND From:$sender AND Received:$Receivedate"


    Aditya Mediratta

    Friday, March 23, 2018 4:34 AM
  • Hi Aditya,

    Only you (the original poster) can "mark as answers", and if there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,
    Albert

    Please remember to mark the replies as an answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, March 23, 2018 6:58 AM
  • jrv,

    I'm posting my tested syntax for the -SearchQuery parameter, as some of your escape characters look like single quotes for some reason, and because in my case I needed to account for spaces in the Sent: portion of the query, because I was using the data as it was pulled from O365 by a PCI scanning tool as a CSV file. (My timestamp format was 12/31/2018T13:21:55.000-07:00 and Search-Mailbox reads this just fine once you replace the capital T with a space. I'll assume that the Received: parameter of Search-Mailbox can read such a timestamp as well.)

    Anyway, here's the syntax I used. I didn't take any chances, and enclosed in quotes the From: and To: same as all the rest.

    -SearchQuery "Subject:`"$subj`" AND Sent:`"$sent`" AND From:`"$from`" AND To:`"$to`""

    • Proposed as answer by Daniel Schultz Wednesday, February 6, 2019 2:08 AM
    Tuesday, February 5, 2019 5:49 AM
  • Here is a much easier and safer way to do this:

    $sq = 'Subject:"{0}" ANDSent:"{1}" AND From:"{2}"AND To:"{3}"' -f $subject, $sent, $from, $to
    -SearchQuery $sq

    It eliminates issues with quotes and impossible to see escape characters.


    \_(ツ)_/

    • Proposed as answer by Daniel Schultz Wednesday, February 6, 2019 2:08 AM
    Tuesday, February 5, 2019 7:15 AM
  • Very elegant solution! I've made note of it.
    Wednesday, February 6, 2019 2:08 AM
  • This was excellent! Is there a way to utilize your method and implement a date range under 'Sent'?  I tried this, but didn't work: $sq = 'From:"{0}" AND Sent:"{1}"' -f $Sender, $StartDate..$EndDate
    Friday, March 15, 2019 9:33 PM
  • This was excellent! Is there a way to utilize your method and implement a date range under 'Sent'?  I tried this, but didn't work: $sq = 'From:"{0}" AND Sent:"{1}"' -f $Sender, $StartDate..$EndDate

    You need to learn how to use the string formatter operator "-f". 

    See:  help about_operators


    \_(ツ)_/

    Friday, March 15, 2019 9:44 PM