How to mark difference between Two CSV

[shugup2923]

Hi Guys,

There is a csv which gets updated every day once with details such as-
VMName Group CPU Memory Storage PowerState

I need to add column as "Any Changes" with value Yes or No.

So that if there is change in values for particular host it should show as yes in "Any Changes" column-
VMName Group CPU Memory Storage PowerState AnyChanges

Note:- This needs to be checked for month,, if there are any changes it should be highlighted in column "Any Changes"

Please let me know how this can be implemented,.

[gcusello]

Hi @shugup2923,
I don't have your data, but see this approach using the distict_count option of stats command:

index=your_index
| stats 
     dc(CPU) AS dc_CPU 
     dc(Memory) AS dc_Memory 
     dc(Storage) AS dc_Storage 
     dc(PowerState) AS dc_PowerState 
     values(CPU) AS CPU 
     values(Memory) AS Memory 
     values(Storage) AS Storage 
     values(PowerState) AS PowerState 
     values(Group) AS Group 
     BY VMName 
| eval AnyChanges=if(dc_CPU>1 OR dc_Memory>1 OR dc_Storage>1 OR dc_PowerState>1,"Yes","No")
| table VMName Group CPU Memory Storage PowerState AnyChanges

Ciao.
Giuseppe

[to4kawa]

index=your_csv
|table columnA columnB columnC ....
|eventstats dc(*) as anychange_*
|eval anychange=0
|foreach anychange_* [ eval anychange=anychange+<<FIELD>>]
|eval "Any Changes"=case(anychange>0,"yes",anychange=0,"no") 
|fields - anychange*

[to4kawa]

Is your Csv indexed daily?

[shugup2923]

Yes every day once