topic Re: How do you compare two CSV files? in Getting Data In

How do you compare two CSV files?

hjsabdjahbd — Tue, 29 Sep 2020 22:21:42 GMT

I have two CSV files: vuln_10_2018 vuln_11_2018, both with the same fields.

I want to compare the files and create a table that shows the lines with the same results.

The fields "Host, Port, protocol, PID and CVE" are my key fields, and the search must be based in these fields to show the persistent results.

Can someone please help me?

hijacob — Thu, 06 Dec 2018 13:43:45 GMT

Hi,

Greetings,
Jacob

hjsabdjahbd — Thu, 06 Dec 2018 13:55:41 GMT

No, I have to bring this visualization in a Splunk Dashboard.

hijacob — Thu, 06 Dec 2018 14:19:29 GMT

hjsabdjahbd — Thu, 06 Dec 2018 17:24:25 GMT

I already tried this way, but it did not work 😕

dkeck — Thu, 06 Dec 2018 17:36:35 GMT

Check this out | set diff

hjsabdjahbd — Thu, 06 Dec 2018 18:26:12 GMT

It does not work, i do not want to show the differences, but the similarities.

martin_mueller — Tue, 11 Dec 2018 19:06:38 GMT

Assuming you have both files indexed,

source=vuln_10_2018 OR source=vuln_11_2018
| stats dc(source) as source_count by Host Port protocol PID CVE
| where source_count=2

hjsabdjahbd — Wed, 09 Jan 2019 15:45:48 GMT

I did with this query:

source="source that i am comparing" [search source="source that a want to compare" rest of the query creating a table] rest of the query with the result that a want.