hi guys I'm new to Splunk
I have two csv files: A and B
A has name, ages, height, weight
B is the limitation factor for A file, it's has name, ages, height, weight too.
how can I list :
where a.name = b.name AND a.ages >b.ages AND a.height < b.height AND a.weight < b.weight
Thank you for your answer.
| inputcsv a.csv
| rename ages as agesA, height as heightA, weight as weightA
| table name agesA heightA weightA
| join type=left
[inputcsv b.csv
| rename ages as agesB, height as heightB, weight as weightB
| table name agesB heightB weightB]
| where agesA>agesB AND heightA<heightB AND weightA<weightB
The renames are not both necessary, but it clarifies which field is which for you.
You could also use a lookup instead of a join, but this one will work fine.
| inputcsv a.csv
| rename ages as agesA, height as heightA, weight as weightA
| table name agesA heightA weightA
| join type=left
[inputcsv b.csv
| rename ages as agesB, height as heightB, weight as weightB
| table name agesB heightB weightB]
| where agesA>agesB AND heightA<heightB AND weightA<weightB
The renames are not both necessary, but it clarifies which field is which for you.
You could also use a lookup instead of a join, but this one will work fine.
Thank you for your answer.