Search to Correlate 2 different csv files.

[krishnacasso]

We have 2 different csv files under the same index and sourcetype.

csv1.csv-Fields[uniquenumber Name status]
csv2.csv-Fields[uniquenumber ID ]

I am trying to correlate csv files using uniquenumber,
we should have values for Name(csv1) & ID(csv2) and if we dint have same value I need to display in a table with details.

display a table like below,

uniquenumber Name ID
1 krishna krish

I am trying a search like below and it is not getting results which I need.

Can some one throw some light on this.
index=* sourcetype=csv | transaction uniquenumber | search Name!=ID | stats values(Name) values(ID) by dc(uniquenumber)

Thanks.

[DalJeanis]

Your search Name!=ID is testing before you have collected those values together onto a single record with the stats command. As such, you are either going to get every record, or no records, depending on how splunk is handling comparison between non-nulls and nulls.

Also, trying to aggregate the stats by dc(uniquenumber) - the distinct count of that field, rather than by the field itself, makes no sense.

That's why praveenbandi's solution, changing the order of those two commands and doing stats by the field, should work for you.

woodcock's partial answer shows an efficient way of coding the same stats command, but at your level I'd suggest that praveenbandi's code is better practice for you, because you need to see and understand precisely what each line is doing, in order for you to master splunk most quickly.

[woodcock]

Like this:

index=* sourcetype=csv | stats values(*) AS * BY uniquenumber

[praveenbandi]

try this, base search | stats values(Name) as Name, values(ID) as ID by uniquenumber | search Name!=ID