Splunk Search

How to find employee manager up to levels above until CEO using dbquery?

LintuMathews
Explorer

I have a report that I run against Oracel db using dbquery to gather the following fields in a table
EMPLOYEEID ,EMPLOYEE FULL NAME, MANAGERID
2561, Mark Antony, 3560
3560, John Roberts , 210
210, Mathew Nathaniel, 6230
31, David Blan, 65

Need help to get an output like one below:-
EmployeeID, EMPLOYEE FULL NAME, MANAGERID LEVEL-1, MANAGER NAME LEVEL-1, MANAGERID LEVEL -2, MANAGER NAME LEVEL-2
2561, Mark Antony, 3560, John Roberts,210, Mathew Nathaniel

Tags (3)
0 Karma

jcoates
Communicator

this is a recursion problem, and because it's unclear how many levels you'll need to go to, you should do it in two steps.

  1. index the data with a simple dbinput
  2. use a dbxlookup to figure out bosses for whoever shows up on the dashboard when you look at the data
0 Karma

LintuMathews
Explorer

the actual data has up to 8 levels that is the maximum we have, for some like the CEO & certain staff will not have supervisor ID

0 Karma

jcoates
Communicator

More than one level is assumed, no one really has a flat organization. It doesn't make any difference to my advice. Missing data is also normal, but not your problem. In fact your dashboard might even inspire people to start fixing the source data.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...