Splunk Search

Calculate mailbox growth comparing previous week

davidcraven02
Communicator

I have the below search that shows the total mailboxSize in GB and I would like to compare this with a week ago to determine the size growth as a raw number in GB and the percentage growth/decrease.

index=msexchange source=otl_exchangemailboxinventory samAccountName=*testuser1*
| eval mailboxSize = totalItemSize+totalDeletedItemSize 
| eval MB = round(mailboxSize/1024) 
| eval mailboxGB = round(MB/1024,2) 
| table samAccountName, totalItemSize, totalDeletedItemSize, mailboxGB
| dedup samAccountName
| sort -mailboxGB

alt text

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Here is an example comparing the number of events this hour compared to the last hour. It calculates the amount and percent increase or decrease. Hope this helps. You should be able to swap out your search.

sourcetype="access_combined" earliest=-1h@h latest=@h 
| stats count as lasthr 
| appendcols 
    [ search sourcetype="access_combined" earliest=-2h@h latest=-1h@h 
    | stats count as previoushr ] 
| eval ChangePercent = round((lasthr - previoushr) / lasthr, 2) 
| eval ChangeAmount = lasthr - previoushr 
| table lasthr previoushr ChangeAmount ChangePercent
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...