Splunk Search

get uncommon results from two files

kavyatim
Path Finder

Hi ,

I am joining two files based on the common field, now i want results which are not common,
how do in get uncommon results from two files.

please find the query used below and help me to get the results that are not common among files:
source="geo.csv" | table city,latitude,longitude
|eval CITY=upper(city) | table CITY,latitude,longitude | rename CITY as Localidade | join Localidade [search source="Areas para CNL .csv"] | table Localidade,AT,latitude,longitude

I need only localidade which is not common between "geo.csv" and "Areas para CNL .csv"

Thanking you

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

View solution in original post

somesoni2
Revered Legend

Try this (assuming you just need list of Localidade which are not common between two sources)

|set diff [search source="geo.csv" |eval Localidade=upper(city) | table Localidade] [search source="Areas para CNL .csv"] | table Localidade]

MuS
Legend

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...