topic Re: How to add values from two CSV files? in Splunk Search

How to add values from two CSV files?

fzhao2 — Mon, 29 Jan 2018 20:07:55 GMT

I have multiple tables, can I add/OR/AND... on each cell of all the tables?

For example, if I have below two tables, and add the corresponding cells,
file1.csv

row_id,0,2,4
0,     0,1,1
2,     0,0,1

file2.csv

row_id,0,2,4
0,     0,1,1
2,     0,1,0

The expected output is:

row_id,0,2,4
0,     0,2,2
2,     0,1,1

Thanks a lot!

Re: How to add values from two CSV files?

elliotproebstel — Mon, 29 Jan 2018 20:53:43 GMT

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

Re: How to add values from two CSV files?

fzhao2 — Tue, 30 Jan 2018 18:25:08 GMT

Thanks so much!