Getting Data In
Highlighted

How do you compare two CSV files?

Observer

I have two CSV files: vuln102018 vuln112018, both with the same fields.

I want to compare the files and create a table that shows the lines with the same results.

The fields "Host, Port, protocol, PID and CVE" are my key fields, and the search must be based in these fields to show the persistent results.

Can someone please help me?

0 Karma
Highlighted

Re: How do you compare two CSV files?

Communicator

Hi,

if you want to do it once and on a easy way you can use Excel...
https://www.mrexcel.com/forum/excel-questions/85861-comparing-two-excel-csv-documents.html

Greetings,
Jacob

0 Karma
Highlighted

Re: How do you compare two CSV files?

Observer

No, I have to bring this visualization in a Splunk Dashboard.

0 Karma
Highlighted

Re: How do you compare two CSV files?

Communicator
0 Karma
Highlighted

Re: How do you compare two CSV files?

Observer

I already tried this way, but it did not work 😕

0 Karma
Highlighted

Re: How do you compare two CSV files?

Influencer
0 Karma
Highlighted

Re: How do you compare two CSV files?

Observer

It does not work, i do not want to show the differences, but the similarities.

0 Karma
Highlighted

Re: How do you compare two CSV files?

SplunkTrust
SplunkTrust

Assuming you have both files indexed,

source=vuln_10_2018 OR source=vuln_11_2018
| stats dc(source) as source_count by Host Port protocol PID CVE
| where source_count=2
0 Karma
Highlighted

Re: How do you compare two CSV files?

Observer

I did with this query:

  • source="source that i am comparing" [search source="source that a want to compare" rest of the query creating a table] rest of the query with the result that a want.
0 Karma