Dashboards & Visualizations

Recommendation for "diff" view between multiline events

Justin_Grant
Contributor

I have two multiline events (they are stuffed with the contents of two versions of a config file) and I'd like a good way to show a view which allows users to examine where the events are different (besides time and/or host, which will of course be different).

Is this kind of view easy to build with Splunk, and if so how would I build it?

Ideally this would be a side-by-side differences view like you can see in TortoiseMerge, WinDiff, or a similar tool. But I'd be happy with something lower-end too (e.g. just a text output listing the differences without any side-by-side UI).

parallaxed
Path Finder

Following on from gkanapathy's comments, this seems easy to build into a view. Sounds like you need simple form or EventsViewer module (or similar), that does something akin to this:

source=/my/config/file | head 2 | diff

This is assuming you want to use the baked-in diff.

You will need to check out some external tools (i.e. GNU diff) if you want to generate a side-by-side look (diff -y or similar) - this could be a scripted input that searches for both events, diffs them, and puts the result back into Splunk through a file or a nifty TCP input - whatever suits.

Seems a bit round the houses, but it's probably better than fiddling with Splunk internals to provide it.

gkanapathy
Splunk Employee
Splunk Employee

Yeah. Probably doable with a scripted input. Current diff is a Python script that uses the Python diff library, and it seems to have some way to generate side-by-side diffs, but it doesn't seem that easy. The regular Unix command line diff can do it though.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...