topic Re: How to do line by line compare and show if there is a difference? in Splunk Enterprise

How to do line by line compare and show if there is a difference?

vrmandadi — Fri, 30 Sep 2022 03:50:32 GMT

I have the following sample event

2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU5 IOS: 96

2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU4 IOS: 96

2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU3 IOS: 96

2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU2 IOS: 96

2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU1 IOS: 76

2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU0 IOS: 96

I want to compare the IOS value for each host and if any one is showing a different value then I want to output the result .In the above events for host=abc all GPU's has IOS value as 96 except for GPU1 which is 76.I want to output the GPU1 and the value of IOS...I tried doing diff but its not working.

Thanks in Advance

Re: How to do line by line compare and show if there is a difference?

johnhuang — Fri, 30 Sep 2022 05:06:24 GMT

Here's one approach you can take:

1. Calculate the most common ios value "common_ios" for each host (using appendpipe and top)
2. Populate the common_ios value to each event using eventstats
3. Look for any ios value that's different than the common_ios value.

| makeresults | eval events="2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU5 IOS: 96;2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU4 IOS: 96;2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU3 IOS: 96;2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU2 IOS: 96;2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU1 IOS: 76;2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU0 IOS: 96" | eval events=SPLIT(events, ";"), host="ACME_SERVER1" | mvexpand events | rex field=events "^.*\]:\s(?<gpu>GPU\d+)\sIOS\:\s+(?<ios>\d+)" | eval gpu_ios=gpu." : ".ios | bucket _time span=1m | appendpipe [| top 1 ios BY _time host | rename ios AS common_ios | table _time common_ios host] | eventstats max(common_ios) AS common_ios values(gpu_ios) AS gpu_ios BY _time host | where LEN(gpu)>1 AND ios!=common_ios | table _time host gpu ios common_ios gpu_ios

Re: How to do line by line compare and show if there is a difference?

vrmandadi — Fri, 30 Sep 2022 16:38:01 GMT

@johnhuang Thank you for you reply.How do I make it work to only look at the latest events for a host(GPU0-GPU5) .Currently it is showing all the results when there is a change but I only want to see the latest and if there is change show only that.

Below is the query I used

Re: How to do line by line compare and show if there is a difference?

johnhuang — Fri, 30 Sep 2022 17:05:52 GMT

Use latest.

Re: How to do line by line compare and show if there is a difference?

vrmandadi — Tue, 04 Oct 2022 21:00:01 GMT

Thank you this worked