topic Re: File Comparision in Splunk Search

File Comparision

akankshayadav — Fri, 21 May 2021 04:35:14 GMT

I have a file which is being indexed(say today) and then again indexed after updating(say tomorrow). I have to compare the events of the two versions and display the event(s) which is present in the new one but not in old or vice versa. Can any help?

Re: File Comparision

ITWhisperer — Fri, 21 May 2021 05:29:41 GMT

How is the file indexed? How do the events differ from day to day? How many events per file when indexed? What else can you say about the indexing process?

Re: File Comparision

akankshayadav — Fri, 21 May 2021 05:50:50 GMT

Files are indexed through inputs.cong .

Files differs as.. example file1 indexed today has 1event ZC_01;11;13;30 and when updated and indexed it has 2 events ZC_01;11;13;30
ZC_01;11;13;29

i have to display the result as... ZC_01;11;13;29 this is the newly added data in the updated file1.

Re: File Comparision

ITWhisperer — Fri, 21 May 2021 06:22:43 GMT

Do the events from the two different days have different timestamps? Do events from the first indexing also appear in the second indexing (just with different timestamps)?

Re: File Comparision

akankshayadav — Fri, 21 May 2021 06:26:00 GMT

This image can help you understand the scenario.

Re: File Comparision

ITWhisperer — Fri, 21 May 2021 06:40:24 GMT

How about something like this

search 1 | append [search 2] | eventstats count by _raw | where count=1

Re: File Comparision

akankshayadav — Fri, 21 May 2021 06:46:33 GMT

Actually sir, i am a very beginner. Can you elaborate the query in an clear way. The above one didn't work. What should i write in place of search 1 and 2?

Re: File Comparision

ITWhisperer — Fri, 21 May 2021 07:03:40 GMT

You might not need two searches if both times the file is indexed they go into the same index

index="compindex" | eventstats count by _raw | where count=1

The problem with defining your question with non-specific or fabricated examples is that the answers are often just as vague and it takes longer to resolve, but this is the price we pay for anonymisation 😁

Re: File Comparision

akankshayadav — Fri, 21 May 2021 07:07:53 GMT

i did this one and got the resutl. thank u sir. and one more help.. how to display it as a table with columns

source time(when file was indexed latest) OnlyThe NewData

Re: File Comparision

ITWhisperer — Fri, 21 May 2021 07:16:10 GMT

index="compindex" | eventstats count by _raw | where count=1 | table source _indextime _raw