$EmailAddress = "user@acmecorp.com"
$FromDate = "2025-12-01"
$ToDate = "2026-05-31"
$SearchName = "Mail_Count"
$CaseName = $SearchName + "_Case"
Connect-IPPSSession -EnableSearchOnlySession
$query = '(To:"'+$EmailAddress+'" OR Cc:"'+$EmailAddress+'") AND Received:'+$FromDate+'..'+$ToDate
New-ComplianceCase $CaseName
New-ComplianceSearch -Name $SearchName -ExchangeLocation All -ContentMatchQuery $query
Start-ComplianceSearch $SearchName
do {
$status = (Get-ComplianceSearch -Identity $SearchName).Status
Write-Host "Current status: $status - $((Get-Date).ToString('HH:mm:ss'))"
if ($status -notin @("Completed", "Failed", "PartiallyCompleted")) {
Start-Sleep -Seconds 15
}
} while ($status -notin @("Completed", "Failed", "PartiallyCompleted"))https://purview.microsoft.com/ediscovery/casespage
At this point, you need to go to Purview, open the case, open the search and do an export.
Put the CSVs in a folder, change the path at the top and run this:
$sourceFolder = "C:\xxx"
Get-ChildItem -Path $sourceFolder -Filter "*.csv" | ForEach-Object {
Write-Host "Processing file: $($_.Name)..." -ForegroundColor Cyan
Import-Csv $_.FullName
} | Where-Object { !([string]::IsNullOrWhiteSpace($_.Date)) } | Select-Object @{
Name = "Month"
Expression = {
# Substring extraction handles ISO-8601 strings quickly
$_.Date.Substring(0, 7)
}
} | Group-Object Month | Select-Object @{Name="Reporting Month"; Expression={$_.Name}}, Count | Sort-Object "Reporting Month" | Format-Table -AutoSize
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article