how to compare two events in one search to highlight what's changed

[sx]

Hi, I am trying to compare the between two events (json format), say, I can pipe with "head 2" to output only two events and then compare them and hight light what's changed, something like this:

<search syntax> | head 2

event 1

    {

        value:  20

         status: high

         category: A

   }

event 2

    {

         value: 25

         status: low

         category: A

   }

Output after compare looks like this or anything that can highlight the changes:

 changed         origin                new

value                  25                     20

status               low                     high

category is unchanged, so won't have to be highlighted. any help is appreciated.

[sx]

To be more clear, the fields could be changed by adding more KV pares, for example, the second event should have a child KV pares like this:

{

    {

         value: 25

         status: low

         category: A

         one_more_field: {

                                key: value

                         }

   }

}

And I want this extra KV pare to be highlighted as well.

[sx]

I think it's a common requirement in our daily operation, no body ever encounter such scenario?

[ITWhisperer · Accepted solution]

Try something like this

<search syntax> | head 2
| spath
| fillnull value="missing or some other random string"
| table list of fields you are interested in
| stats values(*) as *
| foreach *
    [| eval mvc_<<FIELD>>=mvcount(<<FIELD>>)]
| eval max_mvc=0
| foreach mvc_*
    [| eval max_mvc=max(max_mvc,<<FIELD>>)]
| where max_mvc > 1

[sx]

it helps, no the exact what I want, but it does work. thank you so much.