Splunk Search

Search to Correlate 2 different csv files.

Path Finder

We have 2 different csv files under the same index and sourcetype.

csv1.csv-Fields[uniquenumber Name status]
csv2.csv-Fields[uniquenumber ID ]

I am trying to correlate csv files using uniquenumber,
we should have values for Name(csv1) & ID(csv2) and if we dint have same value I need to display in a table with details.

display a table like below,

uniquenumber Name ID
1 krishna krish

I am trying a search like below and it is not getting results which I need.

Can some one throw some light on this.
index=* sourcetype=csv | transaction uniquenumber | search Name!=ID | stats values(Name) values(ID) by dc(uniquenumber)


Tags (1)
0 Karma


Your search Name!=ID is testing before you have collected those values together onto a single record with the stats command. As such, you are either going to get every record, or no records, depending on how splunk is handling comparison between non-nulls and nulls.

Also, trying to aggregate the stats by dc(uniquenumber) - the distinct count of that field, rather than by the field itself, makes no sense.

That's why praveenbandi's solution, changing the order of those two commands and doing stats by the field, should work for you.

woodcock's partial answer shows an efficient way of coding the same stats command, but at your level I'd suggest that praveenbandi's code is better practice for you, because you need to see and understand precisely what each line is doing, in order for you to master splunk most quickly.

0 Karma

Esteemed Legend

Like this:

index=* sourcetype=csv | stats values(*) AS * BY uniquenumber
0 Karma


try this, base search | stats values(Name) as Name, values(ID) as ID by uniquenumber | search Name!=ID

Get Updates on the Splunk Community!

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...