topic Re: Compare text strings over 2 days in Alerting

Compare text strings over 2 days

ssaenger — Wed, 05 Jan 2022 15:13:01 GMT

Hello,

i have a log file which is capturing processed files.

The file text always has the same string, its just the date prefix which changes.
So i would like to read in the files processed today and compare to yesterday and how the difference.

I have used the answers to other questions to get the file date read in by day, however the diff command does not work, is this only for integers rather than string.

Successfully processed file 20211105-zone-Foo Bar1.txt

Successfully processed file 20211105-zone-Bar 1.txt

Successfully processed file 20211106_zone-Foo Bar1.txt

Successfully processed file 20211106-zone-Bar Foo1.txt

i would like to report that Bar 1.txt and Bar Foo1.txt are the differences.

Re: Compare text strings over 2 days

richgalloway — Thu, 06 Jan 2022 00:55:25 GMT

The diff command does indeed work on strings, but produces output like that of the Linux diff command, which probably is not what you seek.

@@ -1 +1 @@ -Bar Foo1.txt Foo Bar1.txt +Bar 1.txt Foo Bar1.txt

I regret that don't know how to solve the problem.

Re: Compare text strings over 2 days

inventsekar — Thu, 06 Jan 2022 03:56:24 GMT

Please check this.. this works fine picking up the Date and File name..

| makeresults | eval log= "Successfully processed file 20211105-zone-Foo Bar1.txt Successfully processed file 20211105-zone-Bar 1.txt Successfully processed file 20211106_zone-Foo Bar1.txt Successfully processed file 20211106-zone-Bar Foo1.txt" | rex field=log max_match=0 "(?P<Date>\d+)\-zone\-(?<File>.+)" | table Date File

i have come up with compare logic, but the eval works only once.. not sure of how to do the eval multiple times.. as you have the real logs, pls check this and update us what happen:

| makeresults | eval log= "Successfully processed file 20211105-zone-Foo Bar1.txt
Successfully processed file 20211105-zone-Bar 1.txt
Successfully processed file 20211106_zone-Foo Bar1.txt
Successfully processed file 20211106-zone-Bar Foo1.txt"
| rex field=log max_match=0 "(?P<Date>\d+)\-zone\-(?<File>.+)"
| eval compare=strptime(Date,"%Y%m%d")
| where compare > strptime(Date,"%Y%m%d")
| table Date File Day

Re: Compare text strings over 2 days

ITWhisperer — Thu, 06 Jan 2022 11:22:07 GMT

| makeresults | eval _raw= "Successfully processed file 20211105-zone-Foo Bar1.txt Successfully processed file 20211105-zone-Bar 1.txt Successfully processed file 20211106-zone-Foo Bar1.txt Successfully processed file 20211106-zone-Bar Foo1.txt" | multikv noheader=t | table _raw ``` The lines above set up example data (correcting typo?) ``` | rex "(?<date>\d+)\-zone\-(?<file>.+)" | stats count by file | where count = 1