Getting Data In

compare 2 csv and display what is not in common

pgbr7
Explorer

Hello Guys,

I Have 2 csv,

LINUX.csv

"Linux Computer"
U-0050
U-0060
U-0065
U-0068
U-0070

DEFENDER.csv

"All Computer"
U-0040
U-0060
U-0065
U-0068
U-0070
U-0073

I try display where DEFENDER.csv != LINUX.csv, in this case the returns are :
U-0040 , U-0073.

I try :

inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv ]
|where "All Computer" != "Linux Computer"

OR

inputlookup LINUX.csv | eval computer="Linux Computer" | append [| inputlookup DEFENDER.csv |eval computer2="All Computer"] | where computer2 != computer

OR

inputlookup LINUX.csv | append [| inputlookup DEFENDER.csv | rename "All Computer" as "Linux Computer"] | stats count by "Linux Computer" | where count > 1

But don't work.

Any suggestions ?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You'll want lists looking like this:

computer,type
U-0050,Linux

Then you can search like this:

| inputlookup a.csv | inputlookup append=t b.csv
| stats values(type) as types by computer
| search NOT types="Linux"

If you can't change your lists you can turn them into this too:

| inputlookup LINUX.csv | eval type="Linux" | append [| inputlookup DEFENDER.csv | eval type="Defender"] | eval computer = coalesce('Linux Computer', 'All Computer')
| stats ... 

View solution in original post

0 Karma

pgbr7
Explorer

Thanks man! Work !

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll want lists looking like this:

computer,type
U-0050,Linux

Then you can search like this:

| inputlookup a.csv | inputlookup append=t b.csv
| stats values(type) as types by computer
| search NOT types="Linux"

If you can't change your lists you can turn them into this too:

| inputlookup LINUX.csv | eval type="Linux" | append [| inputlookup DEFENDER.csv | eval type="Defender"] | eval computer = coalesce('Linux Computer', 'All Computer')
| stats ... 
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>