Splunk Search

Comparing a bunch of config files to a gold master

OL
Communicator

I know that we have diff function that allow the comparison two config files. This is working the way I want. However, I'm trying to find a way to compare a large amount of config files, show only the one which are different and avoiding typing a search for each single config file.

The use case is that I want know the difference at the config files level between a master environment and another one.

Any idea anyone? Sorry if this is too trivial question

Tags (2)

sloshburch
Splunk Employee
Splunk Employee

I've been working on this a LOT. In my case, these files are xml so there is extra complexity.

Try this. It will give you a nice table that shows what's different and what's the same. I've cleaned it of my companies info so its a bit generic. I put greater than/less than in place of where you'd customize stuff.

| set diff [ search ] [ search ] | transaction source | transpose | rename "row 1" as row1, "row 2" as row2 | eval compare=if(row1 == row2, "same", "diff") | sort compare, column | where (row1 != "") AND (row2 !="")

The key is the transpose and the fact that you need to rename the rows to names without spaces to do compares.

You'll likely find many extra meta fields you can remove with the fields tag.

Good luck.

sunrise
Contributor

Thank you, Slosh Burch.
This is very helpful.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...