topic Re: Compare CSV data with Splunk Data in Splunk Search

How to compare CSV data with Splunk data?

Khuzair81 — Wed, 25 Jan 2023 15:14:13 GMT

Please help with the query on how to compare CSV data with Splunk event and get those data in result which is not available in csv.

Thanks

Re: Compare CSV data with Splunk Data

ITWhisperer — Wed, 25 Jan 2023 11:00:05 GMT

It depends on what you have in your events and what you have in your csv.

If there is always a field in the csv which isn't in the events, you could use lookup to find all the matching events and where the extra field is null, no match was found.

If all fields in the csv appear in the event fields, you could append the csv with inputlookup and the use stats to count the occurrences of all the fields from the csv and where the count is 1 and the event came from the index search, it is missing from the csv.

Re: Compare CSV data with Splunk Data

scelikok — Wed, 25 Jan 2023 11:02:48 GMT

Hi @Khuzair81,

I assume you have a lookup as lookup.csv contains src field and trying to compare src field values in your events src field does not exist in lookup.

You can try the below as a sample.

index=_internal NOT [|inputlookup lookup.csv | fields src | format]

Re: Compare CSV data with Splunk Data

Khuzair81 — Wed, 25 Jan 2023 11:11:16 GMT

Hi, in the CSV file in there is a field.

Brand : Puma, Adidas

SplunkEvents

Brand : Puma, Adidas, Nike, Gucci, LV

I want the result as

Brand : Nike, Gucci, LV

Re: Compare CSV data with Splunk Data

ITWhisperer — Wed, 25 Jan 2023 11:15:51 GMT

With such a simple csv, @scelikok approach is easier.

index=<your index> NOT [|inputlookup <your csv> | format]