Litigation Hold status

ajromero — Tue, 22 Sep 2020 00:31:49 GMT

I have a litigation hold report and I need to display if the account is disable. I created a lookup table so I can display user full and if the account is disable. when I pull data from the lookup table I can't display the status

Here is my search

|eval Total=round((Total/1000/1000/1000),2)
|rename name as "Mailbox User Name",Total as "Mailbox Size (GB)"

in the lookup table I have this: name, User, status

for example : name: Rumer, Shelly, status: disable

in my final report all I see the name, database, total

i'm not able to display the status

thank you

Re: Litigation Hold status

to4kawa — Tue, 22 Sep 2020 00:36:24 GMT

eventtype=msexchange-mailbox-usage Database="*" Database="*" LitigationHoldEnabled=True
| dedup User
| table User, TotalDeletedItemSize, TotalItemSize, Database, Total, LitigationHoldEnable
| addtotals fieldname=Total
| stats max(Total) as Total by User, Database
| lookup ActiveDirectoryUsers.csv User OUTPUT name, status
| eval Total=round((Total/1000/1000/1000),2)
| rename name as "Mailbox User Name",Total as "Mailbox Size (GB)"
| fields - User

topic Re: Litigation Hold status in Reporting

Litigation Hold status

Re: Litigation Hold status