Getting Data In

Inputlookup CSV two files, mapp table1 (file1) with table1 (file2) AND show the other information from file 2 in table 2,3,4....

buzek
Explorer

Hi
i`m new in splunk - i do not find the answer here in > answers
as my list_2 do have some other account information, i need to compare two lists

the search should be:
- show me all identical numbers (accountId) from table 1 (field1) in list_1 and, in list_2 (also in table/field1 - accountId).

file_1.csv

accountId
    123
    234
    345

file_2.csv

accountId, Name, City, accountId2
123, John, Texas,BA001
999, Paul, Vienna,BA009
345, Emma, New York,BA008
567, Smith, Indiana,BA004

Result should be:
Show me all customer, that are in file_1 AND file_2 (in table accountId).
The result should show also the information like accountId, name, city - taken from the list_2

in this example:

accountId, Name, City
    123, John, Texas,BA001
    345, Emma, New York,BA008
0 Karma
1 Solution

renjith_nair
Legend

@buzek,

Try this

|inputlookup file1.csv| lookup file2.csv accountId OUTPUT Name, City|where Name!=""
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@buzek,

Try this

|inputlookup file1.csv| lookup file2.csv accountId OUTPUT Name, City|where Name!=""
---
What goes around comes around. If it helps, hit it with Karma 🙂

buzek
Explorer

thank you so much - works!

0 Karma

buzek
Explorer

and, how is the query:
show me all that are in list_1 but NOT in list 2?
thanks

0 Karma

buzek
Explorer

i think i got it:
(the table INC is new in my list - INC = Incident Number)
|inputlookup test_file1.csv | lookup file2.csv accountId OUTPUT Name, City, INC|where accountId!=""
| fillnull value=null INC | stats count by INC | where INC="null"

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...