https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253794#M75969 <P>@somesoni2: Thanks for the response. As I am a beginner can you please help me how to create a index in my scenario, I mean how to change the inputs.conf and props.conf files based on this scenario.</P> Mon, 30 Jan 2017 07:34:31 GMT ibmrakesh 2017-01-30T07:34:31Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253792#M75967 <P>Hi All,<BR /> I am new to Splunk world, Please help me to explore.</P> <P>I have two CSV files let's say </P> <PRE><CODE>table_1.csv with fields 'Bus No', 'Booking ID', 'start Time', 'End Time', 'Source', 'Destination' table_2.csv with fields 'Bus No', 'Booking ID', 'Via','Halting Timings','Passenger counts', 'Failures', etcs. </CODE></PRE> <P>I need to somehow join the two csv files to get the details i.e 'Bus No', 'Booking ID', 'Passenger counts', 'Failures', 'start Time', 'End Time', 'Source', 'Destination' but the condition is like below.<BR /> If there are any failures ( i.e failures &gt; 0 ) in table_2.csv file, then get the 'Bus No', 'Booking ID' from the table_2.csv file and match with the 'Bus No', 'Booking ID' field in table_1.csv. If it is there, then get the information of 'Bus No', 'Booking ID', 'Passenger counts', 'Failures', 'start Time', 'End Time', 'Source', 'Destination' in output.</P> <P>Thanks In Adv.</P> Tue, 29 Sep 2020 12:32:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253792#M75967 ibmrakesh 2020-09-29T12:32:57Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253793#M75968 <P>Assuming the csv data is indexed in Splunk, give this a try</P> <PRE><CODE>index=foo sourcetype=bar (source=*table_1.csv OR source=*table_2.csv) | table "Bus No" "Booking ID" "start Time" "End Time" "Source" "Destination" "Via" "Halting Timings" "Passenger counts" "Failures" | stats values(*) as * by "Bus No" "Booking ID" | where 'Failures'&gt;0 </CODE></PRE> Wed, 25 Jan 2017 20:47:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253793#M75968 somesoni2 2017-01-25T20:47:20Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253794#M75969 <P>@somesoni2: Thanks for the response. As I am a beginner can you please help me how to create a index in my scenario, I mean how to change the inputs.conf and props.conf files based on this scenario.</P> Mon, 30 Jan 2017 07:34:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-the-results-of-searches-from-two-CSV-files/m-p/253794#M75969 ibmrakesh 2017-01-30T07:34:31Z