How to find difference in JSON file as in given below?

karthi2809 — Tue, 28 Jun 2022 03:23:20 GMT

Hi,

Thanks in advance

Below events is in splunk .We have two repos in git 1. AAA 2.BBB.When ever the repos will replicate and both repos should be same file. But in my case after replicate both repos files are missing so i should compare the files and whare are the files is missing and send an alert as difference in repos.

INTERESTING FIELDS:

CODE.Modified_files{}

TOOLKIT.Modified_files{}

Expected output after comparing:

CODE.Modified_files{}

"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master",
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json"

TOOLKIT.Modified_files{}

"a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master"

These files are only present in AAA repo but not in BBB. So we need compare both AAA and BBB missing files. As per the event and show the difference.

{ "CODE": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/config", "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/config", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master", "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json" ] } } { "TOOlKIT": { "modified_files": [ "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/config", "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/HEAD", "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/config", "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master", ] } }

Re: How to find difference in JSON file as in given below?

ITWhisperer — Fri, 01 Jul 2022 18:56:19 GMT

Assuming each event covers one repository and has a field called json with the files

| spath input=json | foreach *.modified_files{} [| eval repo=if(isnotnull('<<FIELD>>'),"<<MATCHSEG1>>",repo) | eval modified_files=if(isnotnull('<<FIELD>>'),'<<FIELD>>',modified_files)] | fields - *.modified_files{} | eval modified_files=mvmap(modified_files,replace(modified_files,"AAA_".repo,"repo")) | eval modified_files=mvmap(modified_files,replace(modified_files,"BBB_".repo,"repo")) | streamstats count as row | stats values(json) as json count by row modified_files | where count = 1 | stats values(modified_files) as modified_files values(json) as json by row

topic How to find difference in JSON file as in given below? in Getting Data In

How to find difference in JSON file as in given below?

INTERESTING FIELDS:

Re: How to find difference in JSON file as in given below?