How do I diff two CSVs?

[daniel333]

all,

I have two CSV and I want to just get the diff between then. Any idea how I tackle this?

thanks,
-Daniel Wilson

[koshyk]

Another method is to do a outer join and filter search which doesn't have a common field

#states1.csv 
state_code,state_name
AL,Alabama
AK,Alaska
AZ,Arizona
AR,Arkansas
DC,District of Columbia
FL,Florida

and say , we need to find the diff to another csv

#states2.csv 
state_code,state_name
AL,Alabama
AK,Alaska
AZ,Arizona
AR,Arkansas

Now if you do a join, and then look the output, you can find null values in fields which doesn't match. Just filter them.

| inputlookup states1.csv | eval file1="states1"| join type=outer state_code [ | inputlookup states2.csv | eval file2="states2"]| search NOT (file2=*)

[peterchenadded]

Try the set diff command

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set

You will want to add an id column if order is important.