Comparing two different sources

[Muthu_Vinith]

Hi Experts, 

I need to compare server lists from two different csv lookups and create a flag based on the comparison results, 
I have two lookups

• abc.csv - contains list of servers being monitored in dashboard
  
  
• def.csv -contains list of servers from another source

• I need to identify servers present in both abc.csv and def.csv
• not found in dashboard (i.e abc.csv)
• and not found in def.csv

How to compare it and create a flag? Any guidance or example queries would be greatly appreciated.
Thank You

[PickleRick]

You should list and categorise them and then do a summarizing stats.

With a normal event search that could be done without appending but since you have the data in lookups you'd need to add a "lookup identifier field" to the lookup contents in order to avoid the append command. Assuming you don't have it, it's something like this:

| inputlookup abc.csv
| eval source=abc.csv
| table  server source
| append
  [ | inputlookup def.csv
     | eval source=def.csv
     | table server source ]

This wil, give you a set of your servers along with an identifier which lookup each server came from.

Now you can do

| stats values(source) as sources by server

And you'll get a multivalued field sources containing either of the source lookups or both of them sk you can use it to filter the data the way you want.

Alternative approach is to not add string labels but numerical ids (like 1 and 2) and then do sum() unstead of values() - then you'd have a field with value 1, 2 or 3 depending on which lookup the server was originally in.

One caveat to the initial building of the list - it uses the append command which has its limitations for run time (which will not be an issue here) and the number of returned results (which might). If you had the field I mentioned at the beginning identifying the lookup, instead of using the append command you could just use another inputlookup command with an append=t option.