topic get uncommon results from two files in Splunk Search

get uncommon results from two files

kavyatim — Tue, 18 Mar 2014 10:23:31 GMT

Hi ,

I am joining two files based on the common field, now i want results which are not common,
how do in get uncommon results from two files.

please find the query used below and help me to get the results that are not common among files:
source="geo.csv" | table city,latitude,longitude
|eval CITY=upper(city) | table CITY,latitude,longitude | rename CITY as Localidade | join Localidade [search source="Areas para CNL .csv"] | table Localidade,AT,latitude,longitude

I need only localidade which is not common between "geo.csv" and "Areas para CNL .csv"

Thanking you

Re: get uncommon results from two files

MuS — Tue, 18 Mar 2014 11:59:44 GMT

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

Re: get uncommon results from two files

somesoni2 — Tue, 18 Mar 2014 14:21:30 GMT

Try this (assuming you just need list of Localidade which are not common between two sources)

|set diff [search source="geo.csv" |eval Localidade=upper(city) | table Localidade] [search source="Areas para CNL .csv"] | table Localidade]