Host Overview - Microsoft Exchange

Host Name Name=" " All Hosts host host |inputlookup hostInformation| where now()-time < 86400|stats count by host -1m now true Cluster Status ClusterStatus=" " All Statuses Active Passive Disabled true Clustered Clustered=" " All Statuses Yes No true Site Name Site=" " All Sites Site Site |inputlookup hostInformation|where now()-time < 86400|stats count by Site -1m now true Role ( OR ) ServerRole=" " All Roles Client Access Server Edge Transport Hub Transport Mailbox Store UM Gateway * Exchange Version ExchangeVersion=" " ExchangeVersion ExchangeVersion All Versions |inputlookup hostInformation| where now()-time < 86400| stats count by ProductVersion | rex field=ProductVersion "(?<MajorVersion>^[^\.]+\.[^\.]+)\." | lookup ExchangeVersion MajorVersion OUTPUT ExchangeVersion | table ExchangeVersion | dedup ExchangeVersion -1m now true Product Version ProductVersion=" " ProductVersion ProductVersion All Versions |inputlookup hostInformation| where now()-time < 86400 | stats count by ProductVersion -1m now true Windows Version WindowsVersion=" " WindowsVersion WindowsVersion All Versions |inputlookup hostInformation| where now()-time < 86400 | stats count by WindowsVersion -1m now true Services ProcsOK=" " All Services Running With Problems true

eventtype=msexchange-topology $Name$ $ClusterStatus$ $Site$ $ProductVersion$ $WindowsVersion$ | eval Clustered = if(isnull(Clustered) OR Clustered=="", "No", Clustered) | eval ServerRole = split(ServerRole, ", ") | search $ServerRole$ | stats latest(Site) as Site, latest(Cluster) as Cluster, latest(ServerRole) as ServerRole, latest(Edition) as Edition, latest(MajorVersion) as MajorVersion, latest(ProductVersion) as ProductVersion, latest(WindowsVersion) as WindowsVersion, latest(WindowsBuild) as WindowsBuild, latest(ProcsOK) as ProcsOK, latest(Clustered) as Clustered by host | search $ProcsOK$ AND $Clustered$ | lookup ExchangeVersion MajorVersion | eval Services=if(ProcsOK=="True","OK","Bad") | sort ServerRole,Cluster,Name | table host,Cluster,Site,ExchangeVersion,ProductVersion,WindowsVersion,WindowsBuild,Services -60m now 20truetrue analyze_a_host?host=$row.host$ 10falsetrue 10falsetrue