Splunk Search

Comparing a bunch of config files to a gold master

OL
Communicator

I know that we have diff function that allow the comparison two config files. This is working the way I want. However, I'm trying to find a way to compare a large amount of config files, show only the one which are different and avoiding typing a search for each single config file.

The use case is that I want know the difference at the config files level between a master environment and another one.

Any idea anyone? Sorry if this is too trivial question

Tags (2)

sloshburch
Splunk Employee
Splunk Employee

I've been working on this a LOT. In my case, these files are xml so there is extra complexity.

Try this. It will give you a nice table that shows what's different and what's the same. I've cleaned it of my companies info so its a bit generic. I put greater than/less than in place of where you'd customize stuff.

| set diff [ search ] [ search ] | transaction source | transpose | rename "row 1" as row1, "row 2" as row2 | eval compare=if(row1 == row2, "same", "diff") | sort compare, column | where (row1 != "") AND (row2 !="")

The key is the transpose and the fact that you need to rename the rows to names without spaces to do compares.

You'll likely find many extra meta fields you can remove with the fields tag.

Good luck.

sunrise
Contributor

Thank you, Slosh Burch.
This is very helpful.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...