Hi,
I am looking for a way to compare a database against an indexed CSV
What I am exactly looking to do is the following
TABLE1
VPPatchID | DATABOUT PATCH |
hash/10034567 blahblah
CSV FILE
IP | DNS | ANOTHER | SOLUTION|
10.50.1.122 COMP1 blahblah blahblahblah hash/10034567
more blahblahblah
I am looking for the command along the lines of
Compare VPPATCHID from TABLE1 with CSVFILE and IF solution CONTAINS EXACT STRING from VPPATCHID then HIDE the row
The theory is that this would then show us a list of machines that are not covered
the other option is if it is possible for splunk to look at the CSV and extract the hash/100***** (always starts with a hash100 followed by 6 digits)
Hopefully you will understand what I am looking to achieve
thanks
paul
Try this (you will have to fix field
names because your casing in your question is inconsistent):
<TABLE 1 Command> | append [| inputcsv table1.csv] | joiner=colesce(VPPATCHID, SOLUTION) | eventstats count AS joinerCount BY joiner | where isnotnull(source) AND joinerCount=1
Or if this is hiding the rows from the wrong source (your question is unclear), then this:
<TABLE 1 Command> | append [| inputcsv table1.csv] | joiner=colesce(VPPATCHID, SOLUTION) | eventstats count AS joinerCount BY joiner | where isnull(source) AND joinerCount=1