Splunk Search

How to add values from two CSV files?

fzhao2
Engager

I have multiple tables, can I add/OR/AND... on each cell of all the tables?

For example, if I have below two tables, and add the corresponding cells,
file1.csv

row_id,0,2,4
0,     0,1,1
2,     0,0,1

file2.csv

row_id,0,2,4
0,     0,1,1
2,     0,1,0

The expected output is:

row_id,0,2,4
0,     0,2,2
2,     0,1,1

Thanks a lot!

0 Karma
1 Solution

elliotproebstel
Champion

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

View solution in original post

elliotproebstel
Champion

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

fzhao2
Engager

Thanks so much!

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...