Getting Data In

Inputlookup CSV two files, mapp table1 (file1) with table1 (file2) AND show the other information from file 2 in table 2,3,4....

buzek
Explorer

Hi
i`m new in splunk - i do not find the answer here in > answers
as my list_2 do have some other account information, i need to compare two lists

the search should be:
- show me all identical numbers (accountId) from table 1 (field1) in list_1 and, in list_2 (also in table/field1 - accountId).

file_1.csv

accountId
    123
    234
    345

file_2.csv

accountId, Name, City, accountId2
123, John, Texas,BA001
999, Paul, Vienna,BA009
345, Emma, New York,BA008
567, Smith, Indiana,BA004

Result should be:
Show me all customer, that are in file_1 AND file_2 (in table accountId).
The result should show also the information like accountId, name, city - taken from the list_2

in this example:

accountId, Name, City
    123, John, Texas,BA001
    345, Emma, New York,BA008
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@buzek,

Try this

|inputlookup file1.csv| lookup file2.csv accountId OUTPUT Name, City|where Name!=""
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@buzek,

Try this

|inputlookup file1.csv| lookup file2.csv accountId OUTPUT Name, City|where Name!=""
Happy Splunking!

buzek
Explorer

thank you so much - works!

0 Karma

buzek
Explorer

and, how is the query:
show me all that are in list_1 but NOT in list 2?
thanks

0 Karma

buzek
Explorer

i think i got it:
(the table INC is new in my list - INC = Incident Number)
|inputlookup test_file1.csv | lookup file2.csv accountId OUTPUT Name, City, INC|where accountId!=""
| fillnull value=null INC | stats count by INC | where INC="null"

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...