https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606609#M210970 <LI-CODE lang="markup">| eval Home=if(Location="office1", "yes", "no") </LI-CODE> Fri, 22 Jul 2022 07:40:52 GMT ITWhisperer 2022-07-22T07:40:52Z https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606578#M210965 <P>Working on a search where there's a field (Office Location) with about 5 different values that are stored in a lookup file. We're looking at attendance at a specific office (office 1) and differentiating who's actually going in. Specifically, we want to isolate people assigned to office 1 and those that are assigned to a different office. The original search looks like this but it would populate all the locations rather than just office 1 or not.</P> <P>&nbsp;</P> <LI-CODE lang="markup">index=index EVDESCR="event" READERDESC="reader" | lookup users.csv ID as EMPLOYEE_ID |timechart span=1d dc(CARDNUM) by Location limit=0</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>I tried using this eval statement to hopefully isolate the search to just two values. Yes, home office or no home office.&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">|eval Home=if(Location"office1", yes, no) </LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;The problem is this eval statement doesn't work and I'm not sure what I'm doing wrong. Any help is appreciated.&nbsp;</P> Fri, 22 Jul 2022 00:42:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606578#M210965 msage 2022-07-22T00:42:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606609#M210970 <LI-CODE lang="markup">| eval Home=if(Location="office1", "yes", "no") </LI-CODE> Fri, 22 Jul 2022 07:40:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606609#M210970 ITWhisperer 2022-07-22T07:40:52Z https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606685#M210991 <P>Tried that and it won't work for whatever reason. All the results are blank</P> Fri, 22 Jul 2022 18:16:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606685#M210991 msage 2022-07-22T18:16:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606689#M210992 <P>Actually you were correct. Not having the quotation marks was what was giving me issues.&nbsp;</P> Fri, 22 Jul 2022 19:08:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-this-eval-statement-to-isolate-the-search-to-just-two/m-p/606689#M210992 msage 2022-07-22T19:08:33Z