https://community.splunk.com/t5/Getting-Data-In/How-to-compare-two-CSV-files-with-multiple-rows/m-p/501252#M85397 <P>Hi,<BR /> You could use the "join " command to achieve functionality.<BR /> Please try the below functionality.Please let us know whether it worked.</P> <PRE><CODE>index=source_file1 souretype=source_file1 |table Date,Status,User |join type=inner User |[search index=source_file2 souretype=source_file2 |eval Date_file2=Date,Status_file2=Status |table Date_file2,Status_file2] |eval match_date=if(Date_file2==Date,1,0),match_status=if(Status_file2==Status,1,0) |where match_date=1 OR match_status=1 |table User,Date,Status </CODE></PRE> Wed, 04 Dec 2019 21:36:42 GMT dindu 2019-12-04T21:36:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-two-CSV-files-with-multiple-rows/m-p/501251#M85396 <P>I am looking to compare two CSV files to output a change or addition. <BR /> Example:</P> <P>File 1:<BR /> <STRONG>User Date Status</STRONG><BR /> Dave 1/1 New<BR /> Linda 1/2 Old<BR /> Bob 1/3 Old</P> <P>File 2:<BR /> <STRONG>User Date Status</STRONG><BR /> Dave 1/1 Old<BR /> Dave 1/2 New<BR /> Linda 1/2 Old<BR /> Tony 1/8 New</P> <P>If the user from File 1 matches File 2 and either row "date" and "status" have changed then output that information plus any new additions. Expected output</P> <P><STRONG>User Date Status</STRONG><BR /> Dave 1/1 Old<BR /> Dave 1/2 New<BR /> Tony 1/8 New</P> Wed, 04 Dec 2019 18:25:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-two-CSV-files-with-multiple-rows/m-p/501251#M85396 vulnfree 2019-12-04T18:25:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-compare-two-CSV-files-with-multiple-rows/m-p/501252#M85397 <P>Hi,<BR /> You could use the "join " command to achieve functionality.<BR /> Please try the below functionality.Please let us know whether it worked.</P> <PRE><CODE>index=source_file1 souretype=source_file1 |table Date,Status,User |join type=inner User |[search index=source_file2 souretype=source_file2 |eval Date_file2=Date,Status_file2=Status |table Date_file2,Status_file2] |eval match_date=if(Date_file2==Date,1,0),match_status=if(Status_file2==Status,1,0) |where match_date=1 OR match_status=1 |table User,Date,Status </CODE></PRE> Wed, 04 Dec 2019 21:36:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-compare-two-CSV-files-with-multiple-rows/m-p/501252#M85397 dindu 2019-12-04T21:36:42Z