Result of two different search

[aalaa]

Hello ,

i have a csv file that contains the list of all existing services, and i have a search already created that gives the active services now, so i need a search that gives me the name of service not active (missing in search result of active services) ==> so how to compare the csv file contents and the active service result to extract the non-active services ?

[gcusello · Accepted solution]

Hi aalaa,
is it the same question of yesterday ( https://answers.splunk.com/answers/774566/compare-output-of-a-search-to-a-lookup-file.html#answer-77... ) or a different one?
Because the answer is the same!

 index=my_index
 | eval service=lower(service)
 | stats count BY service
 | append [ | inputlookup Oracle_services.csv | eval count=0, service=lower(service) | fields count service ]
 | stats sum(count) AS Total BY service
 | where Total=0

Bye.
Giuseppe

[aalaa]

Hi ,

it doesn't work for me , i need another proposition please