Splunk Search

comparing data from index and input table

60150134
New Member

Hi Everyone,

Thanks for your support too.

I have indexed data of staff events from a source. One field in that data is "Surname".

I have an input table of all staff, field 1 is "Surname".

Please can you help me to report on all staff names from the input CSV that do not have events in the indexed data?

Thank you so much!

0 Karma

jpolvino
Builder

Something like this might help.

(your indexed search that returns Surname)
| stats count AS SurnameCount by Surname
| inputlookup staff_lookup.csv append=true
| chart sum(surnameCount) as abc by Surname
| eval abc=if(isnotnull(abc),abc,0)
| where abc=0

This uses a sentinel value concept, better explained here: https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf on slide 25

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...