Jump to content

Email filtering process question with multiple domains


Recommended Posts

Hi Brains Trust - just throwing this out there in case someone smarter than I can figure this out, because I've been going over it for an hour and am giving up! :D

I have a case with primarily PST files as the source material.

We have 6 "subgroups of interest" based on email domains.

  1. Emails To @domain1
  2. Emails From @domain1
  3. Emails To @domain2
  4. Emails From @domain2
  5. Emails To all other domains
  6. Emails From all other domains

2, 4 and 6 are simple - restrict to Type>Email and use the Check boxes in the search "Options" to filter From/Sender on domain1 and tag #2, filter on domain2 and tag #4, exclude those 2 tags and the remainder is #6

Likewise 1 and 3 are simple - use the Check boxes in the search "Options" to filter To/CC/BCC on domain1 and tag #1, filter on domain2 and tag #2

Where it gets tricky is that any given email can be To/CC/BCC multiple domains. Tags groups #1 and #3 will already include emails that were also sent to any other domain as well as the domain of interest (and this is ok, we're happy for this - if we want only that domain we can mess with recipient count, To only, etc).

I can't just exclude #1 and #3 and tag the remainder as #5 as there are emails in #1 and #3 that have also been sent to "other domains".

The only way I can think of to do this is to use the "Email Address" facet and expand "All Receivers" and manually ctrl click to select the "all other" addresses.

There are the two filtering options down the bottom of that pane where I know I can put in say @domain1 but that filters to include that domain, I tried "!@domain1" and "not:domain1" to try to do a negative filter on the list but that didn't work.

There are some 553k addresses in "Email Address" > "All Receivers" so the manual approach is not, shall we say, "appealing" or "tenable".

Has anyone had to solve this problem before or can think of a way to do this?


Link to comment
Share on other sites

I don't know if you can use boolean operators in the search field the way you mentioned. To use a boolean operator in your query, you must write it in upper case.

E.g., from:(@domain1 OR @domain2) NOT(from:(@domain3 OR @domain4))

I was just about to share a spreadsheet I created to build a few helpful queries. I"ll go do that now. Check out my posting on that here: 


Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...