Splunk Search

Comparing a bunch of config files to a gold master

OL
Communicator

I know that we have diff function that allow the comparison two config files. This is working the way I want. However, I'm trying to find a way to compare a large amount of config files, show only the one which are different and avoiding typing a search for each single config file.

The use case is that I want know the difference at the config files level between a master environment and another one.

Any idea anyone? Sorry if this is too trivial question

Tags (2)

sloshburch
Splunk Employee
Splunk Employee

I've been working on this a LOT. In my case, these files are xml so there is extra complexity.

Try this. It will give you a nice table that shows what's different and what's the same. I've cleaned it of my companies info so its a bit generic. I put greater than/less than in place of where you'd customize stuff.

| set diff [ search ] [ search ] | transaction source | transpose | rename "row 1" as row1, "row 2" as row2 | eval compare=if(row1 == row2, "same", "diff") | sort compare, column | where (row1 != "") AND (row2 !="")

The key is the transpose and the fact that you need to rename the rows to names without spaces to do compares.

You'll likely find many extra meta fields you can remove with the fields tag.

Good luck.

sunrise
Contributor

Thank you, Slosh Burch.
This is very helpful.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...