Splunk Search

How to add values from two CSV files?

fzhao2
Engager

I have multiple tables, can I add/OR/AND... on each cell of all the tables?

For example, if I have below two tables, and add the corresponding cells,
file1.csv

row_id,0,2,4
0,     0,1,1
2,     0,0,1

file2.csv

row_id,0,2,4
0,     0,1,1
2,     0,1,0

The expected output is:

row_id,0,2,4
0,     0,2,2
2,     0,1,1

Thanks a lot!

0 Karma
1 Solution

elliotproebstel
Champion

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

View solution in original post

elliotproebstel
Champion

Generally speaking, it's not a great idea to name your fields (or, in this case, your columns) with numbers, because that will make difficult code in Splunk. But in this case, you won't actually need to reference them directly at all:

| inputlookup file1.csv
| append 
 [ | inputlookup file2.csv ]
| stats sum(*) AS * BY row_id

fzhao2
Engager

Thanks so much!

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...