Splunk Search

How to compare CSV data with Splunk data?

Khuzair81
Path Finder

Please help with the query on how to compare CSV data with Splunk event and get those data in result which is not available in csv.

Thanks

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Khuzair81,

I assume you have a lookup as lookup.csv contains src field and trying to compare src field values in your events src field does not exist in lookup.

You can try the below as a sample.

index=_internal NOT [|inputlookup lookup.csv | fields src | format]

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

It depends on what you have in your events and what you have in your csv.

If there is always a field in the csv which isn't in the events, you could use lookup to find all the matching events and where the extra field is null, no match was found.

If all fields in the csv appear in the event fields, you could append the csv with inputlookup and the use stats to count the occurrences of all the fields from the csv and where the count is 1 and the event came from the index search, it is missing from the csv.

0 Karma

Khuzair81
Path Finder

Hi, in the CSV file in there is a field.  

Brand : Puma, Adidas

SplunkEvents

Brand : Puma, Adidas, Nike, Gucci, LV

I want the result as

Brand : Nike, Gucci, LV

 

 

 

 

 

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

With such a simple csv, @scelikok approach is easier.

index=<your index> NOT [|inputlookup <your csv> | format]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...