How to combine a csv and savedsearch and retrieve matching and unmatching results ?

[kavyamohan]

I have a savedsearch which is a result of json data. Similarly I have a master csv. I have Assettag field common in both savedsearch and csv. Now, I want to combine both json and csv and get matching and unmatching results from both and also if Assettag is available in savedsearch but not in csv then it should be given Validation as Newly Scanned and if Assettag is available in csv but not in savedsearch then the Validation is Unscanned and if Assettag is available in both then it is Scanned. where Validation is a new field which should be created. How can I do this? 

[thambisetty · Accepted solution]

you can modify as you need. but below is the procedure to get results what you are expecting.

| your search # here, you have got search results from saved search and result has field called tag assuming.
| eval source="savedsearch"
| append [ | inputlookup yourcsvlookup.csv | table tag | eval source="lookup"]
| stats dc(source) as dc_source values(*) as * by tag
| eval validation=case(source=="savedsearch" AND dc_source=="1","Newly scanned",source=="lookup" AND dc_source=="1","Unscanned",dc_source=="2","scanned",1=1,"Other")