Name Name eventtype=msexchange-throttling-policies|stats count by Name -24h now true
User List eventtype=msexchange-mailbox-usage ThrottlingPolicy="$Name$" |stats count by User |table User |sort User -24h now
Global Limits eventtype=msexchange-throttling-policies Name="$Name$" |head 1 |fillnull value="Unlimited" MessageRateLimit,RecipientRateLimit,ForwardeeLimit |`fix-unlimited-value(MessageRateLimit)` |`fix-unlimited-value(RecipientRateLimit)` |`fix-unlimited-value(ForwardeeLimit)` |stats latest(MessageRateLimit) as MessageRateLimit,latest(RecipientRateLimit) as RecipientRateLimit,latest(ForwardeeLimit) as ForwardeeLimit |transpose |rename column as Limit,"row 1" as "Value" -24h now
Per-Protocol Limits eventtype=msexchange-throttling-policies Name="$Name$" |head 1 |table * |transpose |rename "row 1" as Value |rex field=column "^(?<f1>.*?)(?<f2>(Max|Percent).*)" |search f2="MaxConcurrency" OR f2="PercentTimeIn*" |chart max(Value) by f1,f2 |rename f1 as Protocol -24h now