Splunk Search

Search to Correlate 2 different csv files.

krishnacasso
Path Finder

We have 2 different csv files under the same index and sourcetype.

csv1.csv-Fields[uniquenumber Name status]
csv2.csv-Fields[uniquenumber ID ]

I am trying to correlate csv files using uniquenumber,
we should have values for Name(csv1) & ID(csv2) and if we dint have same value I need to display in a table with details.

display a table like below,

uniquenumber Name ID
1 krishna krish

I am trying a search like below and it is not getting results which I need.

Can some one throw some light on this.
index=* sourcetype=csv | transaction uniquenumber | search Name!=ID | stats values(Name) values(ID) by dc(uniquenumber)

Thanks.

Tags (1)
0 Karma

DalJeanis
Legend

Your search Name!=ID is testing before you have collected those values together onto a single record with the stats command. As such, you are either going to get every record, or no records, depending on how splunk is handling comparison between non-nulls and nulls.

Also, trying to aggregate the stats by dc(uniquenumber) - the distinct count of that field, rather than by the field itself, makes no sense.

That's why praveenbandi's solution, changing the order of those two commands and doing stats by the field, should work for you.

woodcock's partial answer shows an efficient way of coding the same stats command, but at your level I'd suggest that praveenbandi's code is better practice for you, because you need to see and understand precisely what each line is doing, in order for you to master splunk most quickly.

0 Karma

woodcock
Esteemed Legend

Like this:

index=* sourcetype=csv | stats values(*) AS * BY uniquenumber
0 Karma

praveenbandi
Explorer

try this, base search | stats values(Name) as Name, values(ID) as ID by uniquenumber | search Name!=ID

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...