Deployment Architecture

Nested loop with compansion

katalinali
Path Finder

I would like to generate a monthly staff attendance report. I have two types of record, (1) monthly annual leave record:
Staff name, 1_Sep, 2_Sep, 3_Sep....
Mary, NA,NA,NA...
John,AL, NA, AL....
(2) daily in time record (e.g for 1 September, suppose the check in time should be before 9:00)
Staff name, in-time
Mary, 9:01
John, NA
Is it possible to make nest loop and generate a monthly report, so that i can determine if the staff is late or not.
The result table:
Staff name, 1_Sep, 2_Sep.....
Mary, YES, NO...
John, NO,NO

Tags (2)
0 Karma

sundareshr
Legend

Here's one approach you could try.

Create a lookup of the annual leave record (say annual_leave.csv). This csv should have 3 columns Staff Day OnLeave (change the format of your current list). Preferably, this should only contain Day when Staff is on leave. (John 1_Sep AL)

Then, run this query for your final report

... | eval dm=strftime(_time, "%-d_%b") | lookup annual_leave.csv Staff AS "Staff name" Day AS dm OUTPUT OnLeave | eval intime=strptime(x, "%-H:%M") | eval starttime=strptime("9:00", "%-H:%M")| eval ontime=case(OnLeave="AL", "N/A", isnull(OnLeave) AND intime>starttime, "No", intime<starttime, "Yes", 1=1, "UNK") | chart values(ontime) as ontime over "Staff name" by dm

Assumptions:
_time should be time from daily in-time record, representing each day of the month
dm format should match format of values in Day field in leave csv.
OnLeave column only has "AL" representing "Leave"

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Analytics Workspace removal in Splunk 10.6

In Splunk Cloud Platform and Splunk Enterprise 10.6, Analytics Workspace is removed from product and no longer ...

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...