Database=" " Database dbquoted |inputlookup dbInformation |eval dbquoted=replace(Database,"\\\\","\\\\\\") |dedup Database sortby Database -1m now true Last 7 days
Database Growth eventtype=msexchange-database-stats $database$ |eval MBSize=round(FileSize/1048576,2) |eval MBCopySize=round(CopyFileSize/1048576,2) |eval MBLogSize=round(LogSize/1048576,2) |timechart fixedrange=t span=60m max(MBSize) as "DB Size", max(MBCopySize) as "Local Copy Size", max(MBLogSize) as "Log Size" Last Backups eventtype=msexchange-database-stats $database$ |stats latest(LastFullBackup) as "Full",latest(LastIncrementalBackup) as "Incremental",latest(LastDifferentialBackup) as "Differential",latest(LastCopyBackup) as "Copy" |transpose |rename column as "Backup Type", "row 1" as "Date/Time"
Log Information eventtype=msexchange-database-stats $database$ |eval LogSize=if(LogSize=="","Not Reported",round(LogSize/1048576,2)) |eval LogPercFree=if(LogPercFree=="","Not Reported",round(LogPercFree,2)) |eval metric=mvappend("LogFolderPath","LogSize","LogPercFree") |mvexpand metric |eval value=case(metric=="LogFolderPath",LogFolderPath,metric=="LogSize",LogSize,metric=="LogPercFree",LogPercFree) |chart latest(value) by metric host
User Information eventtype=msexchange-mailbox-usage $database$ |stats latest(TotalItemSize) as TotalItemSize by User,Database |stats sum(TotalItemSize) as TotalItemSize,dc(User) as UserCount by Database |eval TotalItemMB=round(TotalItemSize/1048576,2) |table Database,UserCount,TotalItemMB |rename UserCount as "User Count", TotalItemMB as "Committed Size (MB)" |eval _drilldownMod=replace(Database,"\\\\","\\\\\\") Database,"User Count","Committed Size (MB)" client_summary?form.database=$row._drilldownMod$&earliest=$earliest$&latest=$latest$
Database I/O Latency eventtype=msexchange-perfmon object="MSExchange Database ==> Instances" (instance="_Total" OR instance="Information Store/_Total") counter="I/O Database * Average Latency" |lookup dbInformation host OUTPUT Database |search $database$ |timechart fixedrange=t bins=120 avg(Value) as "Latency" Backup History eventtype=msexchange-database-stats $database$ |dedup LastFullBackup, LastIncrementalBackup, LastDifferentialBackup, LastCopyBackup consecutive=T |eval T_LastFullBackup= strptime(LastFullBackup, "%m/%d/%y %H:%M:%S") |eval T_LastIncrementalBackup= strptime(LastIncrementalBackup, "%m/%d/%y %H:%M:%S") |eval T_LastDifferentialBackup=strptime(LastDifferentialBackup, "%m/%d/%y %H:%M:%S") |eval T_LastCopyBackup= strptime(LastCopyBackup, "%m/%d/%y %H:%M:%S") |eval T_LastFullBackup= if(isnull(T_LastFullBackup), strptime(LastFullBackup, "%m/%d/%Y %H:%M:%S"), T_LastFullBackup) |eval T_LastIncrementalBackup= if(isnull(T_LastIncrementalBackup), strptime(LastIncrementalBackup, "%m/%d/%Y %H:%M:%S"), T_LastIncrementalBackup) |eval T_LastDifferentialBackup=if(isnull(T_LastDifferentialBackup), strptime(LastDifferentialBackup, "%m/%d/%Y %H:%M:%S"), T_LastDifferentialBackup) |eval T_LastCopyBackup= if(isnull(T_LastCopyBackup), strptime(LastCopyBackup, "%m/%d/%Y %H:%M:%S"), T_LastCopyBackup) |delta T_LastFullBackup as D_LastFullBackup |delta T_LastIncrementalBackup as D_LastIncrementalBackup |delta T_LastDifferentialBackup as D_LastDifferentialBackup |delta T_LastCopyBackup as D_LastCopyBackup |eval Type=case(D_LastFullBackup!=0, "Full", D_LastIncrementalBackup!=0, "Incremental", D_LastDifferentialBackup!=0, "Differential", D_LastCopyBackup!=0, "Copy") |eval Time=case(D_LastFullBackup!=0, LastFullBackup, D_LastIncrementalBackup!=0, LastIncrementalBackup, D_LastDifferentialBackup!=0, LastDifferentialBackup, D_LastCopyBackup!=0, LastCopyBackup) |search Type=* |sort -Time |eval FileSize=FileSize/(1024*1024) |rename Time as "Date/Time", FileSize as "Database Size (MB)" |table "Date/Time", Type, "Database Size (MB)"