https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618541#M214991 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250708">@nihvk</a>,</P><P>I supose that you want the differences between the full record, in other words considering the three columns.</P><P>In this case, you could try something like this:</P><LI-CODE lang="markup">| inputlookup test1.csv | eval lookup="test1.csv" | append [ | inputlookup test2.csv | eval lookup="test1.csv" | fields hashValue, updatedTime, alertName lookup ] | stats dc(lookup) AS lookup_count values(lookup) AS lookup BY hashValue updatedTime alertName | eval status=if(lookup_count=2,"Both lookups",lookup) | where lookup_count=1 | table lookup hashValue updatedTime alertName</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 27 Oct 2022 07:24:02 GMT gcusello 2022-10-27T07:24:02Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618539#M214990 <P>This is my first question here!&nbsp;And I just started my journey with Splunk.</P><P>I have two files <STRONG>test1.csv</STRONG> and <STRONG>test2.csv</STRONG> with same column names in both the files: hashValue, updatedTime, alertName.&nbsp;</P><P>How do I compare both the files w.r.t there column values and output only the difference?</P><P>Thanks&nbsp;</P> Thu, 27 Oct 2022 07:09:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618539#M214990 nihvk 2022-10-27T07:09:49Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618541#M214991 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250708">@nihvk</a>,</P><P>I supose that you want the differences between the full record, in other words considering the three columns.</P><P>In this case, you could try something like this:</P><LI-CODE lang="markup">| inputlookup test1.csv | eval lookup="test1.csv" | append [ | inputlookup test2.csv | eval lookup="test1.csv" | fields hashValue, updatedTime, alertName lookup ] | stats dc(lookup) AS lookup_count values(lookup) AS lookup BY hashValue updatedTime alertName | eval status=if(lookup_count=2,"Both lookups",lookup) | where lookup_count=1 | table lookup hashValue updatedTime alertName</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 27 Oct 2022 07:24:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618541#M214991 gcusello 2022-10-27T07:24:02Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618869#M215079 <P>Thank you <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>for your prompt answer.&nbsp; This works as I wanted to it to be.&nbsp; Cheers!</P> Mon, 31 Oct 2022 07:14:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618869#M215079 nihvk 2022-10-31T07:14:45Z https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618876#M215084 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/250708">@nihvk</a>,</P><P>good for you, see next time!</P><P>Please accept one answer for the other people of Community</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Mon, 31 Oct 2022 08:05:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-lookup-two-files-with-same-column-name-and-display-only/m-p/618876#M215084 gcusello 2022-10-31T08:05:08Z