Compare/Diff of two events - probably novice question...q

[fribert]

I have this index called cisco_configs. Data input is of type backup_file. It is actually a Cisco IOS configuration file. This works perfectly. Every time the configuration file is updated, an event containing the complete confuration file get into the index. Is there a way to compare two events (two different configuration files) and show only the differences between the two, Just like the UNIX diff command on two files. Thanks in advance.

[meno]

Here is my example configuration:

inputs.conf
[fschange:/logs/fschange/]
fullEvent = true

Unfortunately this produces single line events of every source file line. This you can avoid by using transaction on a short time span to collate the lines.

The complete search with a diff on the full event looks like this:

* | transaction maxspan=1s | diff pos1=1 pos2=3

[gkanapathy]

And even if you do use fschange, setting similar parameters on the sourcetype as in the example will work to keep the file together.

[gkanapathy]

It may be helpful to look at my second answer here: http://answers.splunk.com/questions/5556/fschange-with-recursetrue-unexpected-results-from-whitelist for an alternative to fschange. It has incidental configuration that forces the entire file to be indexed as a single event.

[Lowell]

It should also be possible to simply disable line breaking at index time.

[ftk]

There is actually a diff command in splunk.

(your search) | diff

Check out the manual page on splunk's diff command here: http://www.splunk.com/base/Documentation/latest/SearchReference/Diff

Best is if you can narrow your search down to just the two files you want to diff, if you can't do that, use the position1 and position2 commands to specify which files you want to compare. Not the most intuitive way, but you should be able to get a hang of it quickly.