Splunk Search

How to compare 2 filename%y%m%d.csv from month appart?

R1k
New Member

Hi fellows!

I have a scheduled job that output a single host list (in a unique Table) every day. the filename is automaticly named to filename_currentdate.csv

What i'm trying to achieve is compare two .csv from a month apart and show the result in the dashboard. I need this to run as a scheduled job too...

You guys have any idea? I'm kinda stuck!

0 Karma

adonio
Ultra Champion

hello there,

couple related answers here:
https://answers.splunk.com/answers/553238/how-do-i-compare-two-lookups-formed-from-reports-w.html
https://answers.splunk.com/answers/588461/comparing-two-lookup-files.html

in general, try something like this:
| inputlookup <LOOKUP1> | lookup <LOOKUP2> ...
hope it helps

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...