comparing csv

[crossap]

Hi,

I am looking for a way to compare a database against an indexed CSV

What I am exactly looking to do is the following

TABLE1

VPPatchID | DATABOUT PATCH |

hash/10034567 blahblah

CSV FILE

IP | DNS | ANOTHER | SOLUTION|
10.50.1.122 COMP1 blahblah blahblahblah hash/10034567

more blahblahblah

I am looking for the command along the lines of

Compare VPPATCHID from TABLE1 with CSVFILE and IF solution CONTAINS EXACT STRING from VPPATCHID then HIDE the row

The theory is that this would then show us a list of machines that are not covered

the other option is if it is possible for splunk to look at the CSV and extract the hash/100***** (always starts with a hash100 followed by 6 digits)

Hopefully you will understand what I am looking to achieve

thanks

paul

[woodcock]

Try this (you will have to fix field names because your casing in your question is inconsistent):

<TABLE 1 Command> | append [| inputcsv table1.csv] | joiner=colesce(VPPATCHID, SOLUTION) | eventstats count AS joinerCount BY joiner | where  isnotnull(source) AND joinerCount=1

Or if this is hiding the rows from the wrong source (your question is unclear), then this:

<TABLE 1 Command> | append [| inputcsv table1.csv] | joiner=colesce(VPPATCHID, SOLUTION) | eventstats count AS joinerCount BY joiner | where  isnull(source) AND joinerCount=1