Email filtering process question with multiple domains

[ShaunC]

Hi Brains Trust - just throwing this out there in case someone smarter than I can figure this out, because I've been going over it for an hour and am giving up!

I have a case with primarily PST files as the source material.

We have 6 "subgroups of interest" based on email domains.

1. Emails To @domain1
2. Emails From @domain1
3. Emails To @domain2
4. Emails From @domain2
5. Emails To all other domains
6. Emails From all other domains

2, 4 and 6 are simple - restrict to Type>Email and use the Check boxes in the search "Options" to filter From/Sender on domain1 and tag #2, filter on domain2 and tag #4, exclude those 2 tags and the remainder is #6

Likewise 1 and 3 are simple - use the Check boxes in the search "Options" to filter To/CC/BCC on domain1 and tag #1, filter on domain2 and tag #2

Where it gets tricky is that any given email can be To/CC/BCC multiple domains. Tags groups #1 and #3 will already include emails that were also sent to any other domain as well as the domain of interest (and this is ok, we're happy for this - if we want only that domain we can mess with recipient count, To only, etc).

I can't just exclude #1 and #3 and tag the remainder as #5 as there are emails in #1 and #3 that have also been sent to "other domains".

The only way I can think of to do this is to use the "Email Address" facet and expand "All Receivers" and manually ctrl click to select the "all other" addresses.

There are the two filtering options down the bottom of that pane where I know I can put in say @domain1 but that filters to include that domain, I tried "!@domain1" and "not:domain1" to try to do a negative filter on the list but that didn't work.

There are some 553k addresses in "Email Address" > "All Receivers" so the manual approach is not, shall we say, "appealing" or "tenable".

Has anyone had to solve this problem before or can think of a way to do this?

Cheers!

[Jacques B]

I don't know if you can use boolean operators in the search field the way you mentioned. To use a boolean operator in your query, you must write it in upper case.

E.g., from:(@domain1 OR @domain2) NOT(from:(@domain3 OR @domain4))

I was just about to share a spreadsheet I created to build a few helpful queries. I"ll go do that now. Check out my posting on that here: