Working on a search where there's a field (Office Location) with about 5 different values that are stored in a lookup file. We're looking at attendance at a specific office (office 1) and differentiating who's actually going in. Specifically, we want to isolate people assigned to office 1 and those that are assigned to a different office. The original search looks like this but it would populate all the locations rather than just office 1 or not.
index=index EVDESCR="event" READERDESC="reader"
| lookup users.csv ID as EMPLOYEE_ID
|timechart span=1d dc(CARDNUM) by Location limit=0
I tried using this eval statement to hopefully isolate the search to just two values. Yes, home office or no home office.
|eval Home=if(Location"office1", yes, no)
The problem is this eval statement doesn't work and I'm not sure what I'm doing wrong. Any help is appreciated.
