Add commas to Exchange Table

I-Man — Wed, 12 Jun 2013 21:23:48 GMT

Splunkers,

I have been trying to add commas to all the default charts on the Exchange app. A few particular searches are giving me issues. I usually just use "eval count=tostring(count, "commas")" and it works like a charm. I am still trying to understand how the following search works and how to add commas to it. Any ideas?

This is the Environment Report - Mailboxes:

eventtype="msexchange-mailbox-usage" User="*"|dedup User|eval mailbox=1|eval mailbox200m=if(TotalItemSize>200000000,1,0)|eval mailbox500m=if(TotalItemSize>500000000,1,0)|eval mailbox1G=if(TotalItemSize>1000000000,1,0)|table User,TotalItemSize,mailbox,mailbox200m,mailbox500m,mailbox1G|addcoltotals labelfield=User label=Totals|search User=Totals|eval avgmailbox=round(TotalItemSize/mailbox)|table mailbox,mailbox200m,mailbox500m,mailbox1G,avgmailbox|rename mailbox as "# Mailboxes", mailbox200m as "# Mailboxes over 200Mb", mailbox500m as "# Mailboxes over 500Mb", mailbox1G as "# Mailboxes over 1Gb", avgmailbox as "Average Mailbox Size"|transpose 5|append [ search eventtype="msexchange-mailbox-usage" User="*"|stats max(TotalItemSize) as maxmailbox|eval column="Maximum Mailbox Size"|eval "row 1"=maxmailbox|table column,"row 1"]|rename column as "Field","row 1" as "Value"

Thanks in advance for any help with this.
I-Man

Re: Add commas to Exchange Table

skylasam_splunk — Wed, 12 Jun 2013 21:42:10 GMT

Try using fieldformat at the end of the search string. Example below -
eventtype="msexchange-mailbox-usage" User=""|dedup User|eval mailbox=1|eval mailbox200m=if(TotalItemSize>200000000,1,0)|eval mailbox500m=if(TotalItemSize>500000000,1,0)|eval mailbox1G=if(TotalItemSize>1000000000,1,0)|table User,TotalItemSize,mailbox,mailbox200m,mailbox500m,mailbox1G|addcoltotals labelfield=User label=Totals|search User=Totals|eval avgmailbox=round(TotalItemSize/mailbox)|table mailbox,mailbox200m,mailbox500m,mailbox1G,avgmailbox|rename mailbox as "# Mailboxes", mailbox200m as "# Mailboxes over 200Mb", mailbox500m as "# Mailboxes over 500Mb", mailbox1G as "# Mailboxes over 1Gb", avgmailbox as "Average Mailbox Size"|transpose 5|append [ search eventtype="msexchange-mailbox-usage" User=""|stats max(TotalItemSize) as maxmailbox|eval column="Maximum Mailbox Size"|eval "row 1"=maxmailbox|table column,"row 1"]|rename column as "Field","row 1" as "Value" | fieldformat Value=tostring(Value,"commas")

topic Add commas to Exchange Table in Splunk Search

Add commas to Exchange Table

Re: Add commas to Exchange Table