Analyze a Host Drive - Microsoft Exchange

Host host host |inputlookup hostInformation |stats count by host -1m now true Drive FileDiskName FileDiskName eventtype=msexchange-database-stats host=$host|s$ earliest_time=-1d latest_time=now |stats count by FileDiskName true

eventtype=msexchange-database-stats host=$host|s$ FileDiskName=$drive|s$ earliest_time=-1d latest_time=now |stats count by Database, host, FileDiskName |table Database, host, FileDiskName |rename Database as "Mailbox Database" |rename host as "Host" |rename FileDiskName as "Drive" | eval _drilldownMod=replace('Mailbox Database',"\\\\","\\\\\\") 10falsetrue database_byname?form.database=$row._drilldownMod$