Hi
i`m new in splunk - i do not find the answer here in > answers
as my list_2 do have some other account information, i need to compare two lists
the search should be:
- show me all identical numbers (accountId) from table 1 (field1) in list_1 and, in list_2 (also in table/field1 - accountId).
file_1.csv
accountId
123
234
345
file_2.csv
accountId, Name, City, accountId2
123, John, Texas,BA001
999, Paul, Vienna,BA009
345, Emma, New York,BA008
567, Smith, Indiana,BA004
Result should be:
Show me all customer, that are in file_1 AND file_2 (in table accountId).
The result should show also the information like accountId, name, city - taken from the list_2
in this example:
accountId, Name, City
123, John, Texas,BA001
345, Emma, New York,BA008
@buzek,
Try this
|inputlookup file1.csv| lookup file2.csv accountId OUTPUT Name, City|where Name!=""
@buzek,
Try this
|inputlookup file1.csv| lookup file2.csv accountId OUTPUT Name, City|where Name!=""
thank you so much - works!
and, how is the query:
show me all that are in list_1 but NOT in list 2?
thanks
i think i got it:
(the table INC is new in my list - INC = Incident Number)
|inputlookup test_file1.csv | lookup file2.csv accountId OUTPUT Name, City, INC|where accountId!=""
| fillnull value=null INC | stats count by INC | where INC="null"