Getting Data In

How do you compare two CSV files?

hjsabdjahbd
Observer

I have two CSV files: vuln_10_2018 vuln_11_2018, both with the same fields.

I want to compare the files and create a table that shows the lines with the same results.

The fields "Host, Port, protocol, PID and CVE" are my key fields, and the search must be based in these fields to show the persistent results.

Can someone please help me?

0 Karma

hjsabdjahbd
Observer

I did with this query:

  • source="source that i am comparing" [search source="source that a want to compare" rest of the query creating a table] rest of the query with the result that a want.
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Assuming you have both files indexed,

source=vuln_10_2018 OR source=vuln_11_2018
| stats dc(source) as source_count by Host Port protocol PID CVE
| where source_count=2
0 Karma

dkeck
Influencer
0 Karma

hjsabdjahbd
Observer

It does not work, i do not want to show the differences, but the similarities.

0 Karma

hijacob
Communicator

Hi,

if you want to do it once and on a easy way you can use Excel...
https://www.mrexcel.com/forum/excel-questions/85861-comparing-two-excel-csv-documents.html

Greetings,
Jacob

0 Karma

hjsabdjahbd
Observer

No, I have to bring this visualization in a Splunk Dashboard.

0 Karma

hijacob
Communicator
0 Karma

hjsabdjahbd
Observer

I already tried this way, but it did not work 😕

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...