Splunk Search

compare two fields and populate missing values

splunklakshman
Explorer

Dear All,
I have a column named called id in file1.csv and id1 in file2.csv .

File1.csv: File2.csv
ID: ID1
1 1
2 2
3

I have loaded into splunk and assign indexes for two files . I have retrieve the extra value 3 from ID(file1.csv) . Can you please help us in writing the splunk search query. Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

... | eval comboID=coalesce(id, ID, id1, ID1)
| stats values(comboID)
0 Karma

splunklakshman
Explorer

Thanks for your posting your query. I have the fields in two indexes 1) ID in (index=idx_test) and ID1 in (index=idx_test1). Can you please help me in writing complete query. Thanks

0 Karma

splunklakshman
Explorer

I have tried the above query, its displaying 0 records. Thanks

0 Karma

DalJeanis
Legend

Did you correct the index names to be the ones you assigned to your files?

0 Karma

woodcock
Esteemed Legend
index=idx_test OR index=idx_test1
| eval comboID=coalesce(id, ID, id1, ID1)
| stats values(comboID)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...