Splunk Search

Comparing / diffing 2 lookup tables

oleg106
Explorer

Hello,

I have 2 CSV lookups updating several times a day.  One (A) is from CMDB with the entire list of assets (hostname, ip, user, os, etc).  The other (B) is a list of installed clients for some product, also containing the hostname.  I would like to get a search/dashboard that lists hosts in A that are not found in B with some of  additional fields.  Have no found a way to do with with 2 lookups, any ideas?  Thanks!

Lookup CSV A: Host1, Host2, Host3
Lookup CSV B: Host1, Host3
Search output: Host2

 

Labels (1)
0 Karma

crlunde
Loves-to-Learn Everything

I am also looking for this same information. Anyone have an answer for this?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...