How to remove additional results from search.

[ericdelacruz]

I have a search that is showing the data I want, but I want to isolate it to a specific team and not show all results with other teams. In the below search I tried to isolate only the Sales team, but am seeing results for other teams as well. I tried specifying at the top only Sales, but that didn't work. Any ideas?

cdr_events ( callingPartyGroup="Sales" OR finalCalledPartyGroup="Sales" )
| eval name=coalesce(callingPartyName, finalCalledPartyName)
| eval group=coalesce(callingPartyGroup,finalCalledPartyGroup)
| eval subgroup=coalesce(callingPartySubgroup, finalCalledPartySubgroup)
| fillnull group subgroup value="NULL"
| append [ | inputlookup groups append=t
| eval duration_in_minutes="0"]
| eval nameGroupSubgroup=name + "---" + group + "---" + subgroup
| chart sum(duration_in_minutes) as minutes over nameGroupSubgroup by day_of_week
| eval nameGroupSubgroup=split(nameGroupSubgroup,"---")
| eval name=mvindex(nameGroupSubgroup,0)
| eval group=mvindex(nameGroupSubgroup,1)
| eval subgroup=mvindex(nameGroupSubgroup,2)
| fields name group subgroup Mon Tue Wed Thu Fri Sat Sun
| addtotals fieldname="Total Minutes"

[somesoni2]

I'm guessing that your lookup table file for "groups" has all the teams and that is causing other teams to show up. Add your Sales team filter to your | append [|inputlookup groups .. query as well