Splunk Search

How to remove additional results from search.

ericdelacruz
Engager

I have a search that is showing the data I want, but I want to isolate it to a specific team and not show all results with other teams. In the below search I tried to isolate only the Sales team, but am seeing results for other teams as well. I tried specifying at the top only Sales, but that didn't work. Any ideas?

cdr_events ( callingPartyGroup="Sales" OR finalCalledPartyGroup="Sales" )
| eval name=coalesce(callingPartyName, finalCalledPartyName)
| eval group=coalesce(callingPartyGroup,finalCalledPartyGroup)
| eval subgroup=coalesce(callingPartySubgroup, finalCalledPartySubgroup)
| fillnull group subgroup value="NULL"
| append [ | inputlookup groups append=t
| eval duration_in_minutes="0"]
| eval nameGroupSubgroup=name + "---" + group + "---" + subgroup
| chart sum(duration_in_minutes) as minutes over nameGroupSubgroup by day_of_week
| eval nameGroupSubgroup=split(nameGroupSubgroup,"---")
| eval name=mvindex(nameGroupSubgroup,0)
| eval group=mvindex(nameGroupSubgroup,1)
| eval subgroup=mvindex(nameGroupSubgroup,2)
| fields name group subgroup Mon Tue Wed Thu Fri Sat Sun
| addtotals fieldname="Total Minutes"

Tags (1)
0 Karma

somesoni2
Revered Legend

I'm guessing that your lookup table file for "groups" has all the teams and that is causing other teams to show up. Add your Sales team filter to your | append [|inputlookup groups .. query as well

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...