Exchange online Purview content search returns same number of emails, for 2 different queries

Question

Exchange online Purview content search returns same number of emails, for 2 different queries

Kostas Valanos 0

Hi all,

I'm using Exchange online Purview content search to search in all mailboxes for the following 2 queries:

Total number of emails containing prefix wtc* in subject, received between 1 Jan 2019 and 20 Oct 2024 (c:c)(subjecttitle:wtc*)(received=2019-01-01..2024-10-18)

Total number of emails containing prefix wtc* in subject, sent between 1 Jan 2019 and 20 Oct 2024 (c:c)(subjecttitle:wtc*)(sent=2019-01-01..2024-10-18)

The problem is that both queries return exactly the same number of emails.

Am I doing something wrong?

Thanks in advance for your support.

Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-23T06:50:50.1766667+00:00
@Kostas Valanos - Thanks for the question and using MS Q&A forum.

Purview's search engine likely processes keywords sequentially. If it finds a match for subjecttitle:wtc* before checking the received or sent date, it will count the email and then move on to the next one, ignoring the date filter.

To ensure the date filter is applied correctly, you need to make the date condition a crucial part of the query, not an afterthought. Try these revised queries:

Emails Received: (received:2019-01-01..2024-10-18 AND subjecttitle:wtc*)

Emails Sent: (sent:2019-01-01..2024-10-18 AND subjecttitle:wtc*)

Using AND explicitly links the date condition (received: or sent:) with the subject condition (subjecttitle:wtc*). This forces the search engine to evaluate both conditions for each email before including it in the results.

If the issue persists, try these troubleshooting steps:

Verify that the mailboxes you are searching have emails that meet the criteria for both sent and received. If the same emails are being sent and received (e.g., emails sent to oneself), they may appear in both queries.

Check if the search is including emails hidden from the mailbox view. Purview's settings might allow for such exclusions, and you might need to adjust the search parameters to account for this.

For more information refer to these documentations: Search tips and tricks

Keyword queries and search conditions for eDiscovery | Microsoft Learn

Hope this helps. Do let us know if you have any further queries.
Kostas Valanos 0 Reputation points

2024-10-23T07:42:54.76+00:00

Hello again,

Kindly note in the image below that after running the search with the suggested queries, the issue persists.

I have verified that person-to-person emails (sent to only one recipient, outside of the company), containing wtc in the subject do exist, which means that total number of received emails should be different than total number of sent emails.

I have also tried searching using the following query (date=2019-01-01..2024-10-18 AND subjecttitle:wtc*), and I still get the same amount of emails (205,955) irrespective of whether those emails were sent or received.

It seems that the condition to search also for emails sent or received, is completely ignored.
Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-24T03:56:49.4033333+00:00

@Kostas Valanos - I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us?
Kostas Valanos 0 Reputation points

2024-10-24T06:07:06.8466667+00:00

Support request number: 2410241420000061
Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-24T06:38:57.6866667+00:00

@Kostas Valanos - We are checking with our internal team regarding your query and will get back to you as soon as possible with an update. Thank you for your patience and understanding.
Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-24T09:27:13.29+00:00

@Kostas Valanos - Could you please share the valid support request number? The one you provided seems to be invalid.
Kostas Valanos 0 Reputation points

2024-10-24T13:24:26.8633333+00:00

Kindly note that this is the SR I received in mail

1 answer

Your answer

Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-23T06:50:50.1766667+00:00

@Kostas Valanos - Thanks for the question and using MS Q&A forum.

Purview's search engine likely processes keywords sequentially. If it finds a match for subjecttitle:wtc* before checking the received or sent date, it will count the email and then move on to the next one, ignoring the date filter.

To ensure the date filter is applied correctly, you need to make the date condition a crucial part of the query, not an afterthought. Try these revised queries:

Emails Received: (received:2019-01-01..2024-10-18 AND subjecttitle:wtc*)

Emails Sent: (sent:2019-01-01..2024-10-18 AND subjecttitle:wtc*)

Using AND explicitly links the date condition (received: or sent:) with the subject condition (subjecttitle:wtc*). This forces the search engine to evaluate both conditions for each email before including it in the results.

If the issue persists, try these troubleshooting steps:

Verify that the mailboxes you are searching have emails that meet the criteria for both sent and received. If the same emails are being sent and received (e.g., emails sent to oneself), they may appear in both queries.

Check if the search is including emails hidden from the mailbox view. Purview's settings might allow for such exclusions, and you might need to adjust the search parameters to account for this.

For more information refer to these documentations: Search tips and tricks

Keyword queries and search conditions for eDiscovery | Microsoft Learn

Hope this helps. Do let us know if you have any further queries.
Kostas Valanos 0 Reputation points

2024-10-23T07:42:54.76+00:00

Hello again,

Kindly note in the image below that after running the search with the suggested queries, the issue persists.

I have verified that person-to-person emails (sent to only one recipient, outside of the company), containing wtc in the subject do exist, which means that total number of received emails should be different than total number of sent emails.

I have also tried searching using the following query (date=2019-01-01..2024-10-18 AND subjecttitle:wtc*), and I still get the same amount of emails (205,955) irrespective of whether those emails were sent or received.

It seems that the condition to search also for emails sent or received, is completely ignored.
Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-24T03:56:49.4033333+00:00

@Kostas Valanos - I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us?
Kostas Valanos 0 Reputation points

2024-10-24T06:07:06.8466667+00:00

Support request number: 2410241420000061
Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-24T06:38:57.6866667+00:00

@Kostas Valanos - We are checking with our internal team regarding your query and will get back to you as soon as possible with an update. Thank you for your patience and understanding.
Ganesh Gurram 5,135 Reputation points Microsoft External Staff

2024-10-24T09:27:13.29+00:00

@Kostas Valanos - Could you please share the valid support request number? The one you provided seems to be invalid.
Kostas Valanos 0 Reputation points

2024-10-24T13:24:26.8633333+00:00

Kindly note that this is the SR I received in mail

Answer 1

So in my experience, one thing that I have discovered is that when you are searching items they are grouped in families when searching, I honestly would not be surprise that you got a equal number of items give the way the items are grouped.

If you use Purview premium or the new Preview you should see when ever you work inside the review set, the top level item is the one response to your specific query, in some instances a top level item and an item under the top level will be responsive. You have the option to not export the family group that way. However, be aware that if you try to export attachments as top level items, ensure you expand and include the associated email it needs that to have a container to export into a pst.

If you only use content search, you may need a review tool.

Share via

Exchange online Purview content search returns same number of emails, for 2 different queries

1 answer

Your answer