comparing files

[thinman]

Hi,

I have three files having similar information, namely: First Names, Second Names, Identification number, so I nedd to make a cross on then getting similar records by 1, 2 or 3 fields, the comparations should be more or less fuzzy.

This search is aim to find observed people.

There is a posibility splunk could do this job? What modules should be required.

Regards,

Julio

[sideview]

I'm not at all sure that there's enough information here to answer your question but sometimes this is a sign that there's a really really simple answer. My apologies if this is completely off the mark.

Assuming the three files are all indexed, and they're indexed with different values for the 'source' field, and assuming source A has a field called 'firstname', source B has a field called secondname etc...

( source=A firstname="fred" ) OR (source=B secondname="fred") OR (source=C id="fred")

If it does, and you want the user to just have a single box that they type the 'fred' into, maybe you're looking to make a "form search" page that uses some similar search as its template.

http://www.splunk.com/base/Documentation/latest/Developer/FormIntro

[sideview]

Well then I think that's the right track for you, and you would populate the pulldown by configuring it with an internal search whose result rows were the observed people.

[thinman]

Yes, I though something like that but soruce files are 1000 - 3000 records and "fred" shoudl be taked from the observed people list. This is for automatically relate a Anti-money Laundry list with client records.

Thanks!