Splunk Search

How edit my search to display a missing field from one table that is found in another table?

cg1992
New Member

I have two CSV files: one is has Server and Customer Name and the other also has the same, but it comes from RV Tools report. I am trying to get missing fields in the first CSV to get updated from the second, but it seems that it is totally getting replaced. My current search is below:

source="Customer.CSV" NOT customer="*"| fields server_name,customer | rename server_name as hostname | join hostname [search source="*RVTools_tabvInfo.csv"|fields hostname, Annotation | rename Annotation as customer]|table hostname, customer | dedup hostname

Example for Customer.csv
HDC01 A
HDC02

HDC03 C

Example for RVTools.csv

HDC01 A1
HDC02 B
HDC03 C1

Desired output
HDC02 B

With the search above, I get the same output as RVTools.csv. Please help out in correcting the search.

Tags (3)
0 Karma

sfatnass
Contributor

try this:

| join type = inner hostname

////////

however you can use

set diff [search source="Customer.CSV" NOT customer="*"| fields server_name,customer | rename server_name as hostname][search source="*RVTools_tabvInfo.csv"|fields hostname, Annotation | rename Annotation as customer]|table hostname, customer | dedup hostname
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...