https://community.splunk.com/t5/Splunk-Search/Compare-multiple-inputlookup-s/m-p/87846#M182178 <P>You could probably do this using <CODE>set diff</CODE>. Something like</P> <PRE><CODE>| set diff [|inputlookup table1.csv] [|inputlookup table2.csv] </CODE></PRE> <P>(So, note that set diff is used at the very start of the search)</P> <P>If you want to diff on specific fields, add <CODE>| field yourfieldofinterest</CODE> at the end of each subsearch.</P> Mon, 08 Apr 2013 20:18:02 GMT Ayn 2013-04-08T20:18:02Z https://community.splunk.com/t5/Splunk-Search/Compare-multiple-inputlookup-s/m-p/87845#M182177 <P>I am looking for a way to compare data from multiple inputlookup csv's. Each CSV has the same exact set of fieldnames (IP, Host, Title). I know that I can list all the data from one csv by running: | inputlookup table1.csv<BR /> but I would like to search multiple table's at once and compare the results from specific fields. Is this possible in Splunk?</P> <P>I imagine it's doable using a subsearch but I haven't had much luck. Things like: | inputlookup table1.csv [ | inputlookup table2.csv ] doesn't seem to work. </P> <P>Anyone have any thoughts on this?<BR /> Thanks in advance!</P> Mon, 08 Apr 2013 19:04:28 GMT https://community.splunk.com/t5/Splunk-Search/Compare-multiple-inputlookup-s/m-p/87845#M182177 aswanda 2013-04-08T19:04:28Z https://community.splunk.com/t5/Splunk-Search/Compare-multiple-inputlookup-s/m-p/87846#M182178 <P>You could probably do this using <CODE>set diff</CODE>. Something like</P> <PRE><CODE>| set diff [|inputlookup table1.csv] [|inputlookup table2.csv] </CODE></PRE> <P>(So, note that set diff is used at the very start of the search)</P> <P>If you want to diff on specific fields, add <CODE>| field yourfieldofinterest</CODE> at the end of each subsearch.</P> Mon, 08 Apr 2013 20:18:02 GMT https://community.splunk.com/t5/Splunk-Search/Compare-multiple-inputlookup-s/m-p/87846#M182178 Ayn 2013-04-08T20:18:02Z