Re: comparing data from index and input table - Splunk Community

Splunk Search

Hi Everyone,

Thanks for your support too.

I have indexed data of staff events from a source. One field in that data is "Surname".

I have an input table of all staff, field 1 is "Surname".

Please can you help me to report on all staff names from the input CSV that do not have events in the indexed data?

Thank you so much!

Something like this might help.

(your indexed search that returns Surname)
| stats count AS SurnameCount by Surname
| inputlookup staff_lookup.csv append=true
| chart sum(surnameCount) as abc by Surname
| eval abc=if(isnotnull(abc),abc,0)
| where abc=0

This uses a sentinel value concept, better explained here: https://conf.splunk.com/session/2015/conf2015-LookupTalk.pdf on slide 25

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...