eDiscovery (KQL) Query Support

In v4.3 of Simply Migration we introduced a powerful new feature to leverage some of Office365’s eDiscovery Center features by adding support Keyword Query Language (KQL) job filtering.

What is this KQL you ask?

KQL is a search query language used by many Microsoft products including SharePoint Search and Exchange server.

To quote Microsoft: A KQL query consists of one or more of the following elements:

  • Free text-keywords—words or phrases
  • Property restrictions

Let’s illustrate with an example

I want to report on all items in my Public Folder estate that contain the phrase “Lorem ipsum” in the subject:

subject:”Lorem ipsum”

But wait, what if I only want to find MEETINGS containing that term:

subject:”Lorem ipsum” AND kind:meeting

I think you can start to see where this is going. Have a look at the following TechNet article for some more examples: Message properties and search operators for In-Place eDiscovery in Exchange 2016

See it in action

We have added the new job filter option “FilterByQuery” to use this functionality in new jobs, in order to create a Simply Migrate job using the above example query, try the following:

PS> New-SMJob -Source ExchangePubFolders -SourceInput me@somecompany.onmicrosoft.com 
-FilterByQuery 'subject:"Lorem ipsum" AND kind:meeting' -Target ReportOnly -SourceCredential $cred -SourceOptions IncludeHold

Note: IncludeHold option must also be set in order to use query filers.

Supported versions

KQL support was introduced to Exchange Server in the 2013 version, so in order to use this feature you will need to be on a a version >= 2013 or Online.

The FilterByQuery option was first added in Simply Migrate v4.3.

 

No Comments

Be the first to start a conversation

Leave a Comment