Splunk Search

uncommon data in lookup files

ND
Path Finder

Hi Team,

 

could you please help to get below query:

I  have 2 lookup files. I want to fetch uncommon data from 1 of the lookup file.

e.g.

1st Lookup file - abc.csv

ID Name

1 abc

2 xyz

2nd Lookup file PQR.csv

ID NAme

1 abc

 

I want to fetch below uncommon data

 

output : 

ID NAme

2 xyz

 

Kindly help to get this.

 

Thanks.

ND

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There are often a number of ways to do this - one way might be

| inputlookup abc.csv
| append
  [|inputlookup PQR.csv]
| stats count by ID Name
| where count=1
0 Karma

ND
Path Finder

@ITWhisperer Thanks for the response.

but I want to display the uncommon data from 1st lookup file.

your response is giving all the unique values form both the lookup files.

 

output I want is : ID from 1st lookup which are not present in 2nd lookup.

 

could you please help with this.

Thanks.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| inputlookup abc.csv
| eval count=1
| append
  [|inputlookup PQR.csv
   | eval count=2]
| stats sum(count) as count by ID Name
| where count=1
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...