Splunk Search

How to compare two matching field from two look up table?

Path Finder

I have two lookup table call lookup1.csv and lookup2.csv both has matching field call fullname.
I want match my lookup1.csv to lookup2.csv and output the value not in the lookup1.csv byt in the lookup2.csv?

| inputlookup lookup1.csv | search NOT [| inputlookup lookup.csv | field fullname]

but this SPL displaying result found in the both look table. Is any way to do this in splunk?



Labels (2)
Tags (3)
0 Karma


Your query is pretty close.  Try the where option to inputlookup and use the format command to put the subsearch results in the right format.

| inputlookup lookup1.csv where NOT [| inputlookup lookup.csv | field fullname | format ]


If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...