Getting Data In

Comparing two huge csv files

salpaysog
Explorer

I have two csv files of email adresses that I want to compare by listing email adresses only available in one (and respectively in the other one). What I want to do is similar to a "minus" operation in SQL.

This issue was already solved in many threads such as:
-https://answers.splunk.com/answers/56586/list-difference-between-two-csv-files.html
-https://answers.splunk.com/answers/386822/how-to-compare-search-and-csv-file.html

However, my csv files are huge (300000+). And most of the email adresses are common to both. I just need to extract the few oddities.

Subsearches and joins are limited (maxout limit of subsearch 10000 in my enterprise edition).

Does anyone have an idea how to use Splunk to solve this?

I have tried to use excel or even written a python script but it takes hell of a time and my computer does not support the calculations...

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi salpaysog,
load files in an index (maybe with a scheduled search by night) and then run a something like the following

index=my_csv_index
| stats value(source) AS source DC(source) AS count BY email
| where count=1

In this way you have only emails that are in one csv file.

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi salpaysog,
load files in an index (maybe with a scheduled search by night) and then run a something like the following

index=my_csv_index
| stats value(source) AS source DC(source) AS count BY email
| where count=1

In this way you have only emails that are in one csv file.

Bye.
Giuseppe

salpaysog
Explorer

This is brilliant thank you Giuseppe!
Works well and very fast.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...