Splunk Search

How to create exception list by comparing two tables .

Hema_Nithya
Explorer

 

 

 

How to get the exception from the below tables. Exception is John who is not HR table .

 

 

User list from the servers.

 

Name ID 
Bill23
Peter24
john 25

 

HR Table 

Name ID 
Bill 23
Peter 24
Anita27
Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like

| inputlookup servers.csv where NOT [|inputlookup HR.csv | format]
---
If this reply helps you, Karma would be appreciated.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Using subsearch results in large number of OR operators.  It's probably more economic just doing stats

| inputlookup servers.csv
| eval CSV = "servers"
| inputlookup append=true HR.csv
| fillnull CSV value=HR
| stats values(CSV) as CSV by Name ID
| where mvcount(CSV) == 1 AND CSV == "servers"

(Again, thanks @richgalloway for demonstrating append mode!)

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...