Try using fieldformat at the end of the search string. Example below -
eventtype="msexchange-mailbox-usage" User=""|dedup User|eval mailbox=1|eval mailbox200m=if(TotalItemSize>200000000,1,0)|eval mailbox500m=if(TotalItemSize>500000000,1,0)|eval mailbox1G=if(TotalItemSize>1000000000,1,0)|table User,TotalItemSize,mailbox,mailbox200m,mailbox500m,mailbox1G|addcoltotals labelfield=User label=Totals|search User=Totals|eval avgmailbox=round(TotalItemSize/mailbox)|table mailbox,mailbox200m,mailbox500m,mailbox1G,avgmailbox|rename mailbox as "# Mailboxes", mailbox200m as "# Mailboxes over 200Mb", mailbox500m as "# Mailboxes over 500Mb", mailbox1G as "# Mailboxes over 1Gb", avgmailbox as "Average Mailbox Size"|transpose 5|append [ search eventtype="msexchange-mailbox-usage" User=""|stats max(TotalItemSize) as maxmailbox|eval column="Maximum Mailbox Size"|eval "row 1"=maxmailbox|table column,"row 1"]|rename column as "Field","row 1" as "Value" | fieldformat Value=tostring(Value,"commas")
... View more