Splunk Search

compare two fields and populate missing values

splunklakshman
Explorer

Dear All,
I have a column named called id in file1.csv and id1 in file2.csv .

File1.csv: File2.csv
ID: ID1
1 1
2 2
3

I have loaded into splunk and assign indexes for two files . I have retrieve the extra value 3 from ID(file1.csv) . Can you please help us in writing the splunk search query. Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

... | eval comboID=coalesce(id, ID, id1, ID1)
| stats values(comboID)
0 Karma

splunklakshman
Explorer

Thanks for your posting your query. I have the fields in two indexes 1) ID in (index=idx_test) and ID1 in (index=idx_test1). Can you please help me in writing complete query. Thanks

0 Karma

splunklakshman
Explorer

I have tried the above query, its displaying 0 records. Thanks

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Did you correct the index names to be the ones you assigned to your files?

0 Karma

woodcock
Esteemed Legend
index=idx_test OR index=idx_test1
| eval comboID=coalesce(id, ID, id1, ID1)
| stats values(comboID)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...