Splunk Search

comparing csv

crossap
Path Finder

Hi,

I am looking for a way to compare a database against an indexed CSV

What I am exactly looking to do is the following

TABLE1

VPPatchID | DATABOUT PATCH |

hash/10034567 blahblah

CSV FILE

IP | DNS | ANOTHER | SOLUTION|
10.50.1.122 COMP1 blahblah blahblahblah hash/10034567

more blahblahblah

I am looking for the command along the lines of

Compare VPPATCHID from TABLE1 with CSVFILE and IF solution CONTAINS EXACT STRING from VPPATCHID then HIDE the row

The theory is that this would then show us a list of machines that are not covered

the other option is if it is possible for splunk to look at the CSV and extract the hash/100***** (always starts with a hash100 followed by 6 digits)

Hopefully you will understand what I am looking to achieve

thanks

paul

Tags (2)
0 Karma

woodcock
Esteemed Legend

Try this (you will have to fix field names because your casing in your question is inconsistent):

<TABLE 1 Command> | append [| inputcsv table1.csv] | joiner=colesce(VPPATCHID, SOLUTION) | eventstats count AS joinerCount BY joiner | where  isnotnull(source) AND joinerCount=1

Or if this is hiding the rows from the wrong source (your question is unclear), then this:

<TABLE 1 Command> | append [| inputcsv table1.csv] | joiner=colesce(VPPATCHID, SOLUTION) | eventstats count AS joinerCount BY joiner | where  isnull(source) AND joinerCount=1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...