Getting Data In

comparing two csv files having similar fields

karthikTIL
Path Finder

I have two files, ping.csv and booking.csv
ping.csv has fields-> Device_NAME,IP,result
booking.csv has fields -> Device_NAME,IP,engaged.
"Device_NAME" and "IP" fields have same similar values in both files.

My question is,i need to display "Device_NAME","IP" field and "engaged" field from "booking.csv", if the corresponding device_name and IP fields have result=down in ping.csv.
please let me know how do i search.

Tags (2)
1 Solution

laithmurad
Path Finder

Looks like you're looking for the join command, assuming both csv files are already indexed by splunk you should be able to that with a query similar to this:

source="ping.csv" result=down | join Device_NAME,IP [search source="booking.csv"] | table Device_NAME,IP,engaged

You can find more information about the join command here: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Join

Hope this helps.

View solution in original post

laithmurad
Path Finder

Looks like you're looking for the join command, assuming both csv files are already indexed by splunk you should be able to that with a query similar to this:

source="ping.csv" result=down | join Device_NAME,IP [search source="booking.csv"] | table Device_NAME,IP,engaged

You can find more information about the join command here: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Join

Hope this helps.

karthikTIL
Path Finder

Thanks.I tried below command and it also worked.
source="booking.csv" [search source="ping.csv" RESULT="Down"|Table Device_NAME ]| Table IP,Engaged

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...