Splunk Search

How to display only matching names from a CSV file with 2 fields?

infra2sec
Path Finder

Hi,

I'd like to have Splunk display only matching names from my .csv data source which has 2 fields.

I'd like to display only the names that are common from either field.

This is what I have and I am lost after this:

source="some.csv" host="somehost" sourcetype="csv" | 

I guess that the fields command might help, but I don't know where to begin.

So you understand what I am trying to do, I have a relative who is related to a bunch of people. Field A shows all the people she is related to. Field B is a list of all of my relatives. Whatever relative names match will help us find the common tie.

Thank you very much in advance!!

1 Solution

woodcock
Esteemed Legend

If I understand you correctly, after you configure your CSV as a lookup, maybe like this:

source="some.csv" host="somehost" sourcetype="csv" | lookup CSVlookup FieldA OUTPUT FieldB AS BfromA | lookup CSVlookup FieldB OUTPUT FieldA AS AfromB  | where isnotnull(AfromB) OR isnotnull(BfromA)

View solution in original post

woodcock
Esteemed Legend

If I understand you correctly, after you configure your CSV as a lookup, maybe like this:

source="some.csv" host="somehost" sourcetype="csv" | lookup CSVlookup FieldA OUTPUT FieldB AS BfromA | lookup CSVlookup FieldB OUTPUT FieldA AS AfromB  | where isnotnull(AfromB) OR isnotnull(BfromA)

infra2sec
Path Finder

I ended up using some excel functionality to make it happen. I can't quite remember what happened when I tried. Sorry that I forgot to come back and provide feedback.

I appreciate the help.

0 Karma

woodcock
Esteemed Legend

You click Accept on this answer (hopefully after adding a bit more detail) to close the Question.

0 Karma

infra2sec
Path Finder

Thanks, will try it. I think we have a close understanding.

0 Karma

woodcock
Esteemed Legend

Did it work?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...