Splunk Search

How do I diff two CSVs?

daniel333
Builder

all,

I have two CSV and I want to just get the diff between then. Any idea how I tackle this?

thanks,
-Daniel Wilson

Tags (2)
0 Karma

koshyk
Super Champion

Another method is to do a outer join and filter search which doesn't have a common field

#states1.csv 
state_code,state_name
AL,Alabama
AK,Alaska
AZ,Arizona
AR,Arkansas
DC,District of Columbia
FL,Florida

and say , we need to find the diff to another csv

#states2.csv 
state_code,state_name
AL,Alabama
AK,Alaska
AZ,Arizona
AR,Arkansas

Now if you do a join, and then look the output, you can find null values in fields which doesn't match. Just filter them.

| inputlookup states1.csv | eval file1="states1"| join type=outer state_code [ | inputlookup states2.csv | eval file2="states2"]| search NOT (file2=*)
0 Karma

peterchenadded
Path Finder

Try the set diff command

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set

You will want to add an id column if order is important.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...