Splunk Search

get uncommon results from two files

kavyatim
Path Finder

Hi ,

I am joining two files based on the common field, now i want results which are not common,
how do in get uncommon results from two files.

please find the query used below and help me to get the results that are not common among files:
source="geo.csv" | table city,latitude,longitude
|eval CITY=upper(city) | table CITY,latitude,longitude | rename CITY as Localidade | join Localidade [search source="Areas para CNL .csv"] | table Localidade,AT,latitude,longitude

I need only localidade which is not common between "geo.csv" and "Areas para CNL .csv"

Thanking you

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

View solution in original post

somesoni2
Revered Legend

Try this (assuming you just need list of Localidade which are not common between two sources)

|set diff [search source="geo.csv" |eval Localidade=upper(city) | table Localidade] [search source="Areas para CNL .csv"] | table Localidade]

MuS
SplunkTrust
SplunkTrust

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...