Splunk Search

get uncommon results from two files

kavyatim
Path Finder

Hi ,

I am joining two files based on the common field, now i want results which are not common,
how do in get uncommon results from two files.

please find the query used below and help me to get the results that are not common among files:
source="geo.csv" | table city,latitude,longitude
|eval CITY=upper(city) | table CITY,latitude,longitude | rename CITY as Localidade | join Localidade [search source="Areas para CNL .csv"] | table Localidade,AT,latitude,longitude

I need only localidade which is not common between "geo.csv" and "Areas para CNL .csv"

Thanking you

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

View solution in original post

somesoni2
Revered Legend

Try this (assuming you just need list of Localidade which are not common between two sources)

|set diff [search source="geo.csv" |eval Localidade=upper(city) | table Localidade] [search source="Areas para CNL .csv"] | table Localidade]

MuS
Legend

Hi kavyatim,

try something like this:

source="geo.csv" OR source="Areas para CNL .csv" | eval CITY=upper(city) | where CITY!=Localidade OR Localidade!=CITY | rename CITY as Localidade | table Localidade,AT,latitude,longitude

You don't need a join because you use two different fields from two different sources. Maybe you need to tune the where statement, I included both compares maybe you need just one. This is untested since I don't have your data.

hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...