<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic compare 2 csv and display what is not in common in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428343#M75052</link>
    <description>&lt;P&gt;Hello Guys,&lt;/P&gt;

&lt;P&gt;I Have 2 csv,&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;&lt;EM&gt;LINUX.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;"Linux Computer"&lt;BR /&gt;
U-0050&lt;BR /&gt;
U-0060&lt;BR /&gt;
U-0065&lt;BR /&gt;
U-0068&lt;BR /&gt;
U-0070&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;&lt;EM&gt;DEFENDER.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;"All Computer"&lt;BR /&gt;
U-0040&lt;BR /&gt;
U-0060&lt;BR /&gt;
U-0065&lt;BR /&gt;
U-0068&lt;BR /&gt;
U-0070&lt;BR /&gt;
U-0073&lt;/P&gt;

&lt;P&gt;I try display where DEFENDER.csv != LINUX.csv, in this case the returns are :&lt;BR /&gt;
&lt;STRONG&gt;U-0040 , U-0073.&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;I try :&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv ] &lt;BR /&gt;
|where "All Computer" != "Linux Computer"&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;inputlookup LINUX.csv | eval computer="Linux Computer" | append [| inputlookup DEFENDER.csv |eval computer2="All Computer"] | where computer2 != computer&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv | rename "All Computer" as "Linux Computer"] | stats count by "Linux Computer" | where count &amp;gt; 1&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;But don't work. &lt;/P&gt;

&lt;P&gt;Any suggestions ?&lt;/P&gt;</description>
    <pubDate>Sat, 27 Apr 2019 19:14:27 GMT</pubDate>
    <dc:creator>pgbr7</dc:creator>
    <dc:date>2019-04-27T19:14:27Z</dc:date>
    <item>
      <title>compare 2 csv and display what is not in common</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428343#M75052</link>
      <description>&lt;P&gt;Hello Guys,&lt;/P&gt;

&lt;P&gt;I Have 2 csv,&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;&lt;EM&gt;LINUX.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;"Linux Computer"&lt;BR /&gt;
U-0050&lt;BR /&gt;
U-0060&lt;BR /&gt;
U-0065&lt;BR /&gt;
U-0068&lt;BR /&gt;
U-0070&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;&lt;EM&gt;DEFENDER.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;"All Computer"&lt;BR /&gt;
U-0040&lt;BR /&gt;
U-0060&lt;BR /&gt;
U-0065&lt;BR /&gt;
U-0068&lt;BR /&gt;
U-0070&lt;BR /&gt;
U-0073&lt;/P&gt;

&lt;P&gt;I try display where DEFENDER.csv != LINUX.csv, in this case the returns are :&lt;BR /&gt;
&lt;STRONG&gt;U-0040 , U-0073.&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;I try :&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv ] &lt;BR /&gt;
|where "All Computer" != "Linux Computer"&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;inputlookup LINUX.csv | eval computer="Linux Computer" | append [| inputlookup DEFENDER.csv |eval computer2="All Computer"] | where computer2 != computer&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv | rename "All Computer" as "Linux Computer"] | stats count by "Linux Computer" | where count &amp;gt; 1&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;But don't work. &lt;/P&gt;

&lt;P&gt;Any suggestions ?&lt;/P&gt;</description>
      <pubDate>Sat, 27 Apr 2019 19:14:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428343#M75052</guid>
      <dc:creator>pgbr7</dc:creator>
      <dc:date>2019-04-27T19:14:27Z</dc:date>
    </item>
    <item>
      <title>Re: compare 2 csv and display what is not in common</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428344#M75053</link>
      <description>&lt;P&gt;You'll want lists looking like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;computer,type
U-0050,Linux
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Then you can search like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| inputlookup a.csv | inputlookup append=t b.csv
| stats values(type) as types by computer
| search NOT types="Linux"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;If you can't change your lists you can turn them into this too:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| inputlookup LINUX.csv | eval type="Linux" | append [| inputlookup DEFENDER.csv | eval type="Defender"] | eval computer = coalesce('Linux Computer', 'All Computer')
| stats ... 
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sat, 27 Apr 2019 23:02:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428344#M75053</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2019-04-27T23:02:31Z</dc:date>
    </item>
    <item>
      <title>Re: compare 2 csv and display what is not in common</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428345#M75054</link>
      <description>&lt;P&gt;Thanks man! Work ! &lt;/P&gt;</description>
      <pubDate>Tue, 30 Apr 2019 16:56:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/compare-2-csv-and-display-what-is-not-in-common/m-p/428345#M75054</guid>
      <dc:creator>pgbr7</dc:creator>
      <dc:date>2019-04-30T16:56:24Z</dc:date>
    </item>
  </channel>
</rss>

