Splunk Search

How to find the delta, what values are missing in lookup table comparing the actual data?

innoce
Path Finder

Hi,

I am facing issues to find delta.

I have:

Lookup Table: testpolicies.csv

Field names in Lookup: policyname

index=test sourcetype =test_sourcetype policy=*

Field names :  policy

Now, need to compare Lookup table with  sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field

Any recommendations will be highly appreciated. Thank you so much.

Labels (1)
0 Karma

innoce
Path Finder

@ITWhisperer  Hi, This is the expected behaviour

data:
policy 1
policy 11
policy 111
policy 2
policy 22
policy 222

testpolicies.csv
policy 11
policy 22
policy 222

Expected result:
policy 1
policy 111
policy 2

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your expected result is the opposite of what you said you are trying to do 


@innoce wrote:

Now, need to compare Lookup table with  sourcetype using policy field and find all the records/rows which are not exist in Lookup table but in sourcetype. This comparison is based on policy field


Please clarify which way round you want it

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=test sourcetype=test_sourcetype NOT [| inputlookup testpolicies.csv | rename policyname as policy | table policy]
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...