Splunk Search

Compare/Diff of two events - probably novice question...q

fribert
Explorer

I have this index called cisco_configs. Data input is of type backup_file. It is actually a Cisco IOS configuration file. This works perfectly. Every time the configuration file is updated, an event containing the complete confuration file get into the index. Is there a way to compare two events (two different configuration files) and show only the differences between the two, Just like the UNIX diff command on two files. Thanks in advance.

meno
Path Finder

Here is my example configuration:

inputs.conf
[fschange:/logs/fschange/]
fullEvent = true

Unfortunately this produces single line events of every source file line. This you can avoid by using transaction on a short time span to collate the lines.

The complete search with a diff on the full event looks like this:

* | transaction maxspan=1s | diff pos1=1 pos2=3
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

And even if you do use fschange, setting similar parameters on the sourcetype as in the example will work to keep the file together.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It may be helpful to look at my second answer here: http://answers.splunk.com/questions/5556/fschange-with-recursetrue-unexpected-results-from-whitelist for an alternative to fschange. It has incidental configuration that forces the entire file to be indexed as a single event.

0 Karma

Lowell
Super Champion

It should also be possible to simply disable line breaking at index time.

ftk
Motivator

There is actually a diff command in splunk.

(your search) | diff

Check out the manual page on splunk's diff command here: http://www.splunk.com/base/Documentation/latest/SearchReference/Diff

Best is if you can narrow your search down to just the two files you want to diff, if you can't do that, use the position1 and position2 commands to specify which files you want to compare. Not the most intuitive way, but you should be able to get a hang of it quickly.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...