Splunk Search

Compare two columns in two lookup files

timyong80
Explorer

Hello.

I have two lookup files:

  1. Firecall.csv
  2. Privileged.csv

Both files contain a column with the same name; Account.

How can I compare both lookup files and output the result where the values in Account (in Firecall.csv) do not exist in Account (in Privileged.csv)? I tried several examples below but they either keeps on running and never ends or it produces an error.

=============method 1========================
index=splunk

[ | inputlookup Firecall.csv | search NOT [ |inputlookup Privileged.csv | table Account]

=============method 2========================

index=splunk

[ | inputlookup ID_Firecall.csv | table Account] NOT index=cyber Action="logon" [|inputlookup Privileged.csv | table Account]

=============method 3========================

index=splunk

|inputlookup Firecall.csv | lookup Privileged.csv Account OUTPUT Account as tempfield | where isnull(tempfield )

Any help would be much appreciated.

Thank you.

0 Karma

srujan9292
Explorer

| inputlookup Firecall.csv| eval Job1="Fail"
| join type=left Account [| inputlookup Privileged.csv | table Account | eval Job1="Pass"]
| search Job1="Fail"

martin_mueller
SplunkTrust
SplunkTrust

You can do something like this:

| inputlookup Firecall.csv | eval file = "firecall" | inputlookup append=t Privileged.csv | eval file = coalesce(file, "privileged")
| stats values(file) as files by Account
| search files="firecall" NOT files="privileged"

The first row will load both files and mark each row with the file name it came from, the second row will merge rows based on the Account field yielding a list of files for that Account value, and the third row will only show rows that exist in firecall but don't exist in privileged.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...