Getting Data In

Comparing two huge csv files

salpaysog
Explorer

I have two csv files of email adresses that I want to compare by listing email adresses only available in one (and respectively in the other one). What I want to do is similar to a "minus" operation in SQL.

This issue was already solved in many threads such as:
-https://answers.splunk.com/answers/56586/list-difference-between-two-csv-files.html
-https://answers.splunk.com/answers/386822/how-to-compare-search-and-csv-file.html

However, my csv files are huge (300000+). And most of the email adresses are common to both. I just need to extract the few oddities.

Subsearches and joins are limited (maxout limit of subsearch 10000 in my enterprise edition).

Does anyone have an idea how to use Splunk to solve this?

I have tried to use excel or even written a python script but it takes hell of a time and my computer does not support the calculations...

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi salpaysog,
load files in an index (maybe with a scheduled search by night) and then run a something like the following

index=my_csv_index
| stats value(source) AS source DC(source) AS count BY email
| where count=1

In this way you have only emails that are in one csv file.

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi salpaysog,
load files in an index (maybe with a scheduled search by night) and then run a something like the following

index=my_csv_index
| stats value(source) AS source DC(source) AS count BY email
| where count=1

In this way you have only emails that are in one csv file.

Bye.
Giuseppe

salpaysog
Explorer

This is brilliant thank you Giuseppe!
Works well and very fast.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...