Tell me about the issue and I’ll help you find the solution you need.
eDiscovery search error when you use KQL format for dates in Exchange 2013 in Office 365 Dedicated
Content provided by Microsoft
Applies to: Microsoft Business Productivity Online DedicatedMicrosoft Business Productivity Online Suite Federal
Consider the following scenario in a Microsoft Office 365 Dedicated environment:
You are a member of the SSA-Discovery Management baseline role group or another role group that's associated with the SSA_Mailbox Search management role.
You try to create or change an existing eDiscovery search in the Exchange admin center.
You specify a SENT or RECEIVED keyword in KQL format when you filter on certain criteria.
In this scenario, you receive the following error message:
The query of mailbox search <name> is invalid. Details: The KQL parser threw an exception.
This error occurs when the mailbox that created the search uses a date format that's incompatible with its own date format as specified in the mailbox's regional configuration. For example, the mailbox of the user who tries to create the eDiscovery search is configured to use the M/d/yyyy format. However, the user tries to create the search by using the d/m/yyyy format. This triggers a KQL parser error.
To resolve this issue, use the following format for the SENT or RECEIVED keywords when you create the KQL search query. This bypasses the mailbox regional configuration settings.