Splunk Search

Comparing a bunch of config files to a gold master

OL
Communicator

I know that we have diff function that allow the comparison two config files. This is working the way I want. However, I'm trying to find a way to compare a large amount of config files, show only the one which are different and avoiding typing a search for each single config file.

The use case is that I want know the difference at the config files level between a master environment and another one.

Any idea anyone? Sorry if this is too trivial question

Tags (2)

sloshburch
Splunk Employee
Splunk Employee

I've been working on this a LOT. In my case, these files are xml so there is extra complexity.

Try this. It will give you a nice table that shows what's different and what's the same. I've cleaned it of my companies info so its a bit generic. I put greater than/less than in place of where you'd customize stuff.

| set diff [ search ] [ search ] | transaction source | transpose | rename "row 1" as row1, "row 2" as row2 | eval compare=if(row1 == row2, "same", "diff") | sort compare, column | where (row1 != "") AND (row2 !="")

The key is the transpose and the fact that you need to rename the rows to names without spaces to do compares.

You'll likely find many extra meta fields you can remove with the fields tag.

Good luck.

sunrise
Contributor

Thank you, Slosh Burch.
This is very helpful.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...