Splunk Search

How to generate a search that will filter data from a CSV file?

laudai
Path Finder

hi guys I'm new to Splunk

I have two csv files: A and B
A has name, ages, height, weight
B is the limitation factor for A file, it's has name, ages, height, weight too.

how can I list :

where a.name = b.name AND a.ages >b.ages AND a.height < b.height AND a.weight < b.weight

Thank you for your answer.

0 Karma
1 Solution

DalJeanis
Legend
| inputcsv a.csv 
| rename ages as agesA, height as heightA, weight as weightA 
| table name agesA heightA weightA
| join type=left 
   [inputcsv b.csv 
    | rename ages as agesB, height as heightB, weight as weightB 
    | table name agesB heightB weightB] 
| where agesA>agesB AND heightA<heightB AND weightA<weightB

The renames are not both necessary, but it clarifies which field is which for you.

You could also use a lookup instead of a join, but this one will work fine.

View solution in original post

DalJeanis
Legend
| inputcsv a.csv 
| rename ages as agesA, height as heightA, weight as weightA 
| table name agesA heightA weightA
| join type=left 
   [inputcsv b.csv 
    | rename ages as agesB, height as heightB, weight as weightB 
    | table name agesB heightB weightB] 
| where agesA>agesB AND heightA<heightB AND weightA<weightB

The renames are not both necessary, but it clarifies which field is which for you.

You could also use a lookup instead of a join, but this one will work fine.

laudai
Path Finder

Thank you for your answer.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...