topic Re: Employee report in Splunk Search

Employee report

dude49 — Tue, 14 May 2024 15:36:16 GMT

Hey guys, I am working a report that needs to show any new employees coming into the company for the last 30 days. Right now I have a report constructed that pulls data for over the last 30 days on all employees for the company. How can I filter out this report to only show employees added to the company the previous month over the last 30 days? I will schedule this report to run weekly.

Re: Employee report

ITWhisperer — Tue, 14 May 2024 15:40:22 GMT

Do you have a report that identifies the employees that were added in the previous month?

Re: Employee report

YoungN — Tue, 14 May 2024 17:53:09 GMT

@dude49,

You would need a field or value that gives you the hire/ start date and then format and eval the value to look for the last 30 days.

Something like the below:

|eval StartDay=strftime(hire_date, "%d") |eval curDay=strftime(now(),"%d") |eval window =(curDay - StarttDay) |where (window < 30)

Reference:

https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions