Splunk Search

How to add values from two CSV files?

fzhao2
Engager

I have multiple tables, can I add/OR/AND... on each cell of all the tables?

For example, if I have below two tables, and add the corresponding cells,
file1.csv

row_id,0,2,4
0,     0,1,1
2,     0,0,1

file2.csv

row_id,0,2,4
0,     0,1,1
2,     0,1,0

The expected output is:

row_id,0,2,4
0,     0,2,2
2,     0,1,1

Thanks a lot!

0 Karma
1 Solution

elliotproebstel
Champion

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

View solution in original post

elliotproebstel
Champion

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

fzhao2
Engager

Thanks so much!

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...