Splunk Search
Highlighted

How to compare 2 columns between 2 lookups?

Contributor

Hi, need help to get difference records between 2 lookups with same column name.

ex: lookup 1 has the data below:
columnname: number
one
two
three
four

lookup 2 has the data below:
columnname: number
one
two
three
five

if anything new shows up in lookup1 which is not found in lookup2, I would like to know what value is being outputted.
Can you help?

John.

0 Karma
Highlighted

Re: How to compare 2 columns between 2 lookups?

SplunkTrust
SplunkTrust
 | inputlookup lookup1 | lookup lookup2 number OUTPUTNEW number as isFound | where isnull(isFound)

View solution in original post

0 Karma
Highlighted

Re: How to compare 2 columns between 2 lookups?

Contributor

That worked as expected, thank you

John.

0 Karma
Highlighted

Re: How to compare 2 columns between 2 lookups?

Legend

@jiagya, you can try the following to get numbers which are not in lookup2 but in lookup1

| inputlookup lookup1.csv where NOT 
    [| inputlookup lookup2.csv 
   | table number]

Just FYI, if you want results which are in both lookup1 and lookup2 then you just need to take out NOT from the above query.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How to compare 2 columns between 2 lookups?

Contributor

Ok, Thanks for the tip Niket