https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/607777#M211340 <P class="lia-align-left">I've been comparing two lookup files, but its more pure arithmetic, where I am trying to implement a true comparison where it looks to match values, and provide a percentage based on which matches were true. So if I have three values in file1, and only two values match in file2, the percentage would equal to 66.6%.</P> <P>&nbsp;</P> <LI-CODE lang="markup">| inputlookup file1 | eventstats dc(Serial Number) as file1_Count | dedup file1_Count | inputlookup append=T file2 | eventstats dc(System Serial Number) as file2_Count | dedup file2 | fields file1_Count,file2_Count | eval percentage=round('file2_Count'/'file1_Count'*100,2)."%"</LI-CODE> <P>&nbsp;</P> Mon, 01 Aug 2022 20:03:45 GMT Minasdad 2022-08-01T20:03:45Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/607777#M211340 <P class="lia-align-left">I've been comparing two lookup files, but its more pure arithmetic, where I am trying to implement a true comparison where it looks to match values, and provide a percentage based on which matches were true. So if I have three values in file1, and only two values match in file2, the percentage would equal to 66.6%.</P> <P>&nbsp;</P> <LI-CODE lang="markup">| inputlookup file1 | eventstats dc(Serial Number) as file1_Count | dedup file1_Count | inputlookup append=T file2 | eventstats dc(System Serial Number) as file2_Count | dedup file2 | fields file1_Count,file2_Count | eval percentage=round('file2_Count'/'file1_Count'*100,2)."%"</LI-CODE> <P>&nbsp;</P> Mon, 01 Aug 2022 20:03:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/607777#M211340 Minasdad 2022-08-01T20:03:45Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/607834#M211347 <P>Consider writing a custom command in Python that accepts two lookup file names, compares them, and returns the percentage match in an output field.</P> Mon, 01 Aug 2022 19:57:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/607834#M211347 richgalloway 2022-08-01T19:57:56Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/608146#M211452 <P>Looking back at the question its not the result I truly want. I believe this is fairly simple but keeps slipping through my fingers.&nbsp; File1.csv has a field of "Serial Number" and File2.csv has a field of "System Serial Number", all I want to do is compare and produce the results that do not match.</P> Wed, 03 Aug 2022 17:30:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/608146#M211452 Minasdad 2022-08-03T17:30:07Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/608151#M211454 <P>Try this approach. Begin by reading one lookup file and marking the entries as "file1".&nbsp; Then read in the other lookup file and mark the entries as "file2".&nbsp; Rename the main column to match the first lookup.&nbsp; Use the <FONT face="courier new,courier">stats</FONT> command to merge the two result sets together, counting them by Serial Number.&nbsp; Any entry with a count less than 2 means one of the lookups was missing that value.&nbsp; The "file1" or "file2" mark will tell you which file has the value so it must be missing from the other one.</P><LI-CODE lang="markup">| inputlookup file1 | eval src="file1" | append [ | inputlookup file2 | eval src="file2" | rename "System Serial Number" as "Serial Number" ] | stats count, values(*) as * by 'Serial Number' | where count &lt; 2 | table "Serial Number" src</LI-CODE><P>&nbsp;</P> Wed, 03 Aug 2022 17:54:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-true-comparison-where-it-matches-values-and/m-p/608151#M211454 richgalloway 2022-08-03T17:54:39Z