compare 2 csv and display what is not in common

[pgbr7]

Hello Guys,

I Have 2 csv,

LINUX.csv

"Linux Computer"
U-0050
U-0060
U-0065
U-0068
U-0070

DEFENDER.csv

"All Computer"
U-0040
U-0060
U-0065
U-0068
U-0070
U-0073

I try display where DEFENDER.csv != LINUX.csv, in this case the returns are :
U-0040 , U-0073.

I try :

inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv ]
|where "All Computer" != "Linux Computer"

OR

inputlookup LINUX.csv | eval computer="Linux Computer" | append [| inputlookup DEFENDER.csv |eval computer2="All Computer"] | where computer2 != computer

OR

inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv | rename "All Computer" as "Linux Computer"] | stats count by "Linux Computer" | where count > 1

But don't work.

Any suggestions ?

[pgbr7]

Thanks man! Work !

[martin_mueller · Accepted solution]

You'll want lists looking like this:

computer,type
U-0050,Linux

Then you can search like this:

| inputlookup a.csv | inputlookup append=t b.csv
| stats values(type) as types by computer
| search NOT types="Linux"

If you can't change your lists you can turn them into this too:

| inputlookup LINUX.csv | eval type="Linux" | append [| inputlookup DEFENDER.csv | eval type="Defender"] | eval computer = coalesce('Linux Computer', 'All Computer')
| stats ...