Calculate mailbox growth comparing previous week

[davidcraven02]

I have the below search that shows the total mailboxSize in GB and I would like to compare this with a week ago to determine the size growth as a raw number in GB and the percentage growth/decrease.

index=msexchange source=otl_exchangemailboxinventory samAccountName=*testuser1*
| eval mailboxSize = totalItemSize+totalDeletedItemSize 
| eval MB = round(mailboxSize/1024) 
| eval mailboxGB = round(MB/1024,2) 
| table samAccountName, totalItemSize, totalDeletedItemSize, mailboxGB
| dedup samAccountName
| sort -mailboxGB

[kmorris_splunk]

Here is an example comparing the number of events this hour compared to the last hour. It calculates the amount and percent increase or decrease. Hope this helps. You should be able to swap out your search.

sourcetype="access_combined" earliest=-1h@h latest=@h 
| stats count as lasthr 
| appendcols 
    [ search sourcetype="access_combined" earliest=-2h@h latest=-1h@h 
    | stats count as previoushr ] 
| eval ChangePercent = round((lasthr - previoushr) / lasthr, 2) 
| eval ChangeAmount = lasthr - previoushr 
| table lasthr previoushr ChangeAmount ChangePercent