all,
I have two CSV and I want to just get the diff between then. Any idea how I tackle this?
thanks,
-Daniel Wilson
Another method is to do a outer join and filter search which doesn't have a common field
#states1.csv
state_code,state_name
AL,Alabama
AK,Alaska
AZ,Arizona
AR,Arkansas
DC,District of Columbia
FL,Florida
and say , we need to find the diff to another csv
#states2.csv
state_code,state_name
AL,Alabama
AK,Alaska
AZ,Arizona
AR,Arkansas
Now if you do a join, and then look the output, you can find null values in fields which doesn't match. Just filter them.
| inputlookup states1.csv | eval file1="states1"| join type=outer state_code [ | inputlookup states2.csv | eval file2="states2"]| search NOT (file2=*)
Try the set diff command
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Set
You will want to add an id column if order is important.