Splunk Search

How edit my search to display a missing field from one table that is found in another table?

cg1992
New Member

I have two CSV files: one is has Server and Customer Name and the other also has the same, but it comes from RV Tools report. I am trying to get missing fields in the first CSV to get updated from the second, but it seems that it is totally getting replaced. My current search is below:

source="Customer.CSV" NOT customer="*"| fields server_name,customer | rename server_name as hostname | join hostname [search source="*RVTools_tabvInfo.csv"|fields hostname, Annotation | rename Annotation as customer]|table hostname, customer | dedup hostname

Example for Customer.csv
HDC01 A
HDC02

HDC03 C

Example for RVTools.csv

HDC01 A1
HDC02 B
HDC03 C1

Desired output
HDC02 B

With the search above, I get the same output as RVTools.csv. Please help out in correcting the search.

Tags (3)
0 Karma

sfatnass
Contributor

try this:

| join type = inner hostname

////////

however you can use

set diff [search source="Customer.CSV" NOT customer="*"| fields server_name,customer | rename server_name as hostname][search source="*RVTools_tabvInfo.csv"|fields hostname, Annotation | rename Annotation as customer]|table hostname, customer | dedup hostname
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...