@spisiakmi You want 2 different searches for your conditions like below? Condition 1: Select rows from tmp1_2.csv where (WorkplaceId,ContractId) is NOT present in tmp1_1.csv as (WorkplaceId,Contra...
See more...
@spisiakmi You want 2 different searches for your conditions like below? Condition 1: Select rows from tmp1_2.csv where (WorkplaceId,ContractId) is NOT present in tmp1_1.csv as (WorkplaceId,Contract) | inputlookup tmp1_2.csv
| eval key=WorkplaceId."-".ContractId
| lookup tmp1_1.csv WorkplaceId as WorkplaceId, Contract as ContractId OUTPUT PK1
| where isnull(PK1)
| table WorkplaceId, State, Timestamp, ContractId Condition 2: Select rows from tmp1_2.csv where (WorkplaceId,ContractId) is present in tmp1_1.csv as (WorkplaceId,Contract) | inputlookup tmp1_2.csv
| eval key=WorkplaceId."-".ContractId
| lookup tmp1_1.csv WorkplaceId as WorkplaceId, Contract as ContractId OUTPUT PK1
| where isnotnull(PK1)
| table WorkplaceId, State, Timestamp, ContractId Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!