Splunk Search

How to compare 2 columns between 2 lookups?

jiaqya
Builder

Hi, need help to get difference records between 2 lookups with same column name.

ex: lookup 1 has the data below:
columnname: number
one
two
three
four

lookup 2 has the data below:
columnname: number
one
two
three
five

if anything new shows up in lookup1 which is not found in lookup2, I would like to know what value is being outputted.
Can you help?

John.

0 Karma
1 Solution

starcher
Influencer
 | inputlookup lookup1 | lookup lookup2 number OUTPUTNEW number as isFound | where isnull(isFound)

View solution in original post

niketn
Legend

@jiagya, you can try the following to get numbers which are not in lookup2 but in lookup1

| inputlookup lookup1.csv where NOT 
    [| inputlookup lookup2.csv 
   | table number]

Just FYI, if you want results which are in both lookup1 and lookup2 then you just need to take out NOT from the above query.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jiaqya
Builder

Ok, Thanks for the tip Niket

starcher
Influencer
 | inputlookup lookup1 | lookup lookup2 number OUTPUTNEW number as isFound | where isnull(isFound)

computermathguy
Explorer

Thanks..... Worked like a charm.

0 Karma

jiaqya
Builder

That worked as expected, thank you

John.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...