Splunk Search

How to lookup two files with same column name and display only the difference?

nihvk
Explorer

This is my first question here! And I just started my journey with Splunk.

I have two files test1.csv and test2.csv with same column names in both the files: hashValue, updatedTime, alertName. 

How do I compare both the files w.r.t there column values and output only the difference?

Thanks 

Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @nihvk,

I supose that you want the differences between the full record, in other words considering the three columns.

In this case, you could try something like this:

| inputlookup test1.csv 
| eval lookup="test1.csv"
| append [ 
   | inputlookup test2.csv 
   | eval lookup="test1.csv"
   | fields hashValue, updatedTime, alertName lookup ]
| stats 
   dc(lookup) AS lookup_count
   values(lookup) AS lookup
   BY hashValue updatedTime alertName
| eval status=if(lookup_count=2,"Both lookups",lookup)
| where lookup_count=1
| table lookup hashValue updatedTime alertName

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @nihvk,

I supose that you want the differences between the full record, in other words considering the three columns.

In this case, you could try something like this:

| inputlookup test1.csv 
| eval lookup="test1.csv"
| append [ 
   | inputlookup test2.csv 
   | eval lookup="test1.csv"
   | fields hashValue, updatedTime, alertName lookup ]
| stats 
   dc(lookup) AS lookup_count
   values(lookup) AS lookup
   BY hashValue updatedTime alertName
| eval status=if(lookup_count=2,"Both lookups",lookup)
| where lookup_count=1
| table lookup hashValue updatedTime alertName

Ciao.

Giuseppe

nihvk
Explorer

Thank you @gcusellofor your prompt answer.  This works as I wanted to it to be.  Cheers!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nihvk,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...