I have two CSV files: vuln_10_2018 vuln_11_2018, both with the same fields.
I want to compare the files and create a table that shows the lines with the same results.
The fields "Host, Port, protocol, PID and CVE" are my key fields, and the search must be based in these fields to show the persistent results.
Can someone please help me?
I did with this query:
Assuming you have both files indexed,
source=vuln_10_2018 OR source=vuln_11_2018
| stats dc(source) as source_count by Host Port protocol PID CVE
| where source_count=2
Check this out | set diff
https://answers.splunk.com/answers/56586/list-difference-between-two-csv-files.html
It does not work, i do not want to show the differences, but the similarities.
Hi,
if you want to do it once and on a easy way you can use Excel...
https://www.mrexcel.com/forum/excel-questions/85861-comparing-two-excel-csv-documents.html
Greetings,
Jacob
No, I have to bring this visualization in a Splunk Dashboard.
maybe this answer solves your problem? https://answers.splunk.com/answers/352921/how-do-i-search-and-compare-fields-from-two-differ.html
I already tried this way, but it did not work 😕