Getting stats for emails delivered with blank subject lines

[Emy Loanzon]

Good Morning!

I have to get stats on how many emails we get that have blank subject lines. I tried these Exchange PS commands:

$subj =$null

Get-MessageTrace -StartDate "02/20/2018" -EndDate "03/20/2018" | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP | Where {$_.messagesubject -eq $subj}

And

Get-MessageTrace -StartDate "02/202018" -EndDate "03/20/2018"  |
Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP | Where {$_.Subj.length -eq "0"}

And

Get-MessageTrace -StartDate "03/17/2018" -EndDate "03/18/2018" |
 Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP | Where{$_.Subject -eq "" }

I kept getting results that have emails that have subject lines.

I tried the Content Search in "Search And Investigation" under the "Security and Compliance" admin, but kept getting emails with subject lines.

Executing the "Search-Mailbox" for blank email subject lines does not get the desired result either.

Any suggestions from the group?

Thank you.

[#2 · Accepted solution]

Search-Mailbox will not work, at least I wasn't able to get it to work when I toyed with this last time. But for message trace, something like this should do it:

Get-MessageTrace -StartDate "02/20/2018" -EndDate "03/20/2018" | Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, ToIP, FromIP | Where {!$_.subject}

You should also be able to use

where ($_.Subject -eq $null)

[#3]

Thank you! That worked.

[#4]

I also discovered another way to get this report...

In Office 365 - Security & Compliance - Reports - Dashboard. Click on the dashboard for "Spam Detections". There is a column for "Subject" - you can see emails sent to the company that have blank subject lines. Unfortunately, the dashboard does not allow a filter for subject lines. I downloaded the report for 30 days and filtered the CSV file on the "Subject" column for the ones that are blank.