Splunk Search

Comparing a bunch of config files to a gold master

OL
Communicator

I know that we have diff function that allow the comparison two config files. This is working the way I want. However, I'm trying to find a way to compare a large amount of config files, show only the one which are different and avoiding typing a search for each single config file.

The use case is that I want know the difference at the config files level between a master environment and another one.

Any idea anyone? Sorry if this is too trivial question

Tags (2)

sloshburch
Splunk Employee
Splunk Employee

I've been working on this a LOT. In my case, these files are xml so there is extra complexity.

Try this. It will give you a nice table that shows what's different and what's the same. I've cleaned it of my companies info so its a bit generic. I put greater than/less than in place of where you'd customize stuff.

| set diff [ search ] [ search ] | transaction source | transpose | rename "row 1" as row1, "row 2" as row2 | eval compare=if(row1 == row2, "same", "diff") | sort compare, column | where (row1 != "") AND (row2 !="")

The key is the transpose and the fact that you need to rename the rows to names without spaces to do compares.

You'll likely find many extra meta fields you can remove with the fields tag.

Good luck.

sunrise
Contributor

Thank you, Slosh Burch.
This is very helpful.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...