Compare two columns in two lookup files

[timyong80]

Hello.

I have two lookup files:

1. Firecall.csv
2. Privileged.csv

Both files contain a column with the same name; Account.

How can I compare both lookup files and output the result where the values in Account (in Firecall.csv) do not exist in Account (in Privileged.csv)? I tried several examples below but they either keeps on running and never ends or it produces an error.

=============method 1========================
index=splunk

[ | inputlookup Firecall.csv | search NOT [ |inputlookup Privileged.csv | table Account]

=============method 2========================

index=splunk

[ | inputlookup ID_Firecall.csv | table Account] NOT index=cyber Action="logon" [|inputlookup Privileged.csv | table Account]

=============method 3========================

index=splunk

|inputlookup Firecall.csv | lookup Privileged.csv Account OUTPUT Account as tempfield | where isnull(tempfield )

Any help would be much appreciated.

Thank you.

[srujan9292]

| inputlookup Firecall.csv| eval Job1="Fail"
| join type=left Account [| inputlookup Privileged.csv | table Account | eval Job1="Pass"]
| search Job1="Fail"

[martin_mueller]

You can do something like this:

| inputlookup Firecall.csv | eval file = "firecall" | inputlookup append=t Privileged.csv | eval file = coalesce(file, "privileged")
| stats values(file) as files by Account
| search files="firecall" NOT files="privileged"

The first row will load both files and mark each row with the file name it came from, the second row will merge rows based on the Account field yielding a list of files for that Account value, and the third row will only show rows that exist in firecall but don't exist in privileged.