Comparing two huge csv files

[salpaysog]

I have two csv files of email adresses that I want to compare by listing email adresses only available in one (and respectively in the other one). What I want to do is similar to a "minus" operation in SQL.

This issue was already solved in many threads such as:
-https://answers.splunk.com/answers/56586/list-difference-between-two-csv-files.html
-https://answers.splunk.com/answers/386822/how-to-compare-search-and-csv-file.html

However, my csv files are huge (300000+). And most of the email adresses are common to both. I just need to extract the few oddities.

Subsearches and joins are limited (maxout limit of subsearch 10000 in my enterprise edition).

Does anyone have an idea how to use Splunk to solve this?

I have tried to use excel or even written a python script but it takes hell of a time and my computer does not support the calculations...

[gcusello · Accepted solution]

Hi salpaysog,
load files in an index (maybe with a scheduled search by night) and then run a something like the following

index=my_csv_index
| stats value(source) AS source DC(source) AS count BY email
| where count=1

In this way you have only emails that are in one csv file.

Bye.
Giuseppe

[salpaysog]

This is brilliant thank you Giuseppe!
Works well and very fast.