How to lookup two files with same column name and display only the difference?

[nihvk]

This is my first question here! And I just started my journey with Splunk.

I have two files test1.csv and test2.csv with same column names in both the files: hashValue, updatedTime, alertName. 

How do I compare both the files w.r.t there column values and output only the difference?

Thanks 

[gcusello · Accepted solution]

Hi @nihvk,

I supose that you want the differences between the full record, in other words considering the three columns.

In this case, you could try something like this:

| inputlookup test1.csv 
| eval lookup="test1.csv"
| append [ 
   | inputlookup test2.csv 
   | eval lookup="test1.csv"
   | fields hashValue, updatedTime, alertName lookup ]
| stats 
   dc(lookup) AS lookup_count
   values(lookup) AS lookup
   BY hashValue updatedTime alertName
| eval status=if(lookup_count=2,"Both lookups",lookup)
| where lookup_count=1
| table lookup hashValue updatedTime alertName

Ciao.

Giuseppe

[nihvk]

Thank you @gcusellofor your prompt answer.  This works as I wanted to it to be.  Cheers!

[gcusello]

Hi @nihvk,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉