topic Comparing two huge csv files in Getting Data In

Comparing two huge csv files

salpaysog — Thu, 27 Dec 2018 13:09:28 GMT

I have two csv files of email adresses that I want to compare by listing email adresses only available in one (and respectively in the other one). What I want to do is similar to a "minus" operation in SQL.

This issue was already solved in many threads such as:
-https://answers.splunk.com/answers/56586/list-difference-between-two-csv-files.html
-https://answers.splunk.com/answers/386822/how-to-compare-search-and-csv-file.html

However, my csv files are huge (300000+). And most of the email adresses are common to both. I just need to extract the few oddities.

Subsearches and joins are limited (maxout limit of subsearch 10000 in my enterprise edition).

Does anyone have an idea how to use Splunk to solve this?

I have tried to use excel or even written a python script but it takes hell of a time and my computer does not support the calculations...

Re: Comparing two huge csv files

gcusello — Thu, 27 Dec 2018 15:24:01 GMT

Hi salpaysog,
load files in an index (maybe with a scheduled search by night) and then run a something like the following

index=my_csv_index
| stats value(source) AS source DC(source) AS count BY email
| where count=1

In this way you have only emails that are in one csv file.

Bye.
Giuseppe

Re: Comparing two huge csv files

salpaysog — Fri, 28 Dec 2018 08:27:50 GMT

This is brilliant thank you Giuseppe!
Works well and very fast.