topic request comparison in Splunk Search

request comparison

gitingua — Thu, 14 Oct 2021 14:47:11 GMT

Hello. How can two files be compared for identity ?

file1.csv:

username	id_user
Jonh	123

file2.csv

username	id_user
Jonh	124

How to write a request correctly. To check if id_user is identical for one user in different files. Compare two files with the same ID or not

if file1.csv.id_user != file2.csv.id_user

There was a message that the id is different

Re: request comparison

ITWhisperer — Thu, 14 Oct 2021 16:03:11 GMT

Re: request comparison

gitingua — Sun, 17 Oct 2021 13:42:13 GMT

@ITWhisperer

But how to make the check on two attributes.

but how to do a check on two attributes. if both are not alike

when I write a check for two attributes using "or". that is, one thing is similar, nothing comes out of my output. And if both are not alike, then everything turns out right

If

file1.csv

user	id_user	group
John	123	56

file2.csv

user	id_user	group
John	124	56

output:

user	id_user1	id_user2	group1	group2
John	123	124	56	56

but need:

user	id_user1	id_user2	group
John	123	124	56

Re: request comparison

ITWhisperer — Sun, 17 Oct 2021 14:09:27 GMT

Re: request comparison

techiesid — Sun, 17 Oct 2021 17:26:25 GMT

@gitingua ,

What about the below solution,

| set diff [| inputlookup file1.csv] [| inputlookup file2.csv] | stats values(group), values(id_user) by user

Sid

Re: request comparison

gitingua — Sun, 17 Oct 2021 17:27:39 GMT

@ITWhisperer Thanks my friend. but can you tell me how to correctly pull data from files using inputlookup? Thanks a lot !!

Re: request comparison

ITWhisperer — Sun, 17 Oct 2021 21:15:08 GMT

Re: request comparison

gitingua — Sun, 17 Oct 2021 21:45:29 GMT

@ITWhisperer You are the best!! Thanks