topic Re: File Comparision in Splunk Search

File Comparision

akankshayadav — Tue, 25 May 2021 06:23:44 GMT

How can we compare different versions of a file?

Re: File Comparision

aasabatini — Tue, 25 May 2021 06:28:00 GMT

Hi @akankshayadav

can you add more details?

this file is already indexed? where are stored the file? maybe it's better a versioning software?

Regards

Alessandro

Re: File Comparision

akankshayadav — Tue, 25 May 2021 06:32:13 GMT

I have a file, say abc.csv, which I indexed once having events a b c , then i indexed it again after some days updating it, having events a b c d, again i indexed it at some point of time, having events a c and again then i uploaded it having events a b c.

My desired output
date 2- d

date 3- c

date 4- same

Re: File Comparision

aasabatini — Tue, 25 May 2021 06:41:06 GMT

Try this search to check when is indexed an event

index=<your index> | eventstats count by _raw | where count=1 | table source _indextime _raw

Re: File Comparision

akankshayadav — Tue, 25 May 2021 06:42:41 GMT

This solution only compares the last and latest ones.. can u give something which compares the latest to all the previous ones.
Regards

Re: File Comparision

aasabatini — Tue, 25 May 2021 07:05:15 GMT

Hi @akankshayadav

this search compares the previous event data to the last event data based on your timerange

| stats min(_indextime) as min_indextime max(_indextime) as max_indextime | convert ctime(min_indextime) ctime(max_indextime)

Re: File Comparision

akankshayadav — Tue, 25 May 2021 07:10:01 GMT

sir can u please elaborate the code , how to frame it properly

Re: File Comparision

aasabatini — Tue, 25 May 2021 07:13:31 GMT

Hi @akankshayadav

please describe how you would like the output search.

Re: File Comparision

akankshayadav — Tue, 25 May 2021 07:15:53 GMT

My desired output
date 2- d

date 3- c

date 4- same

Re: File Comparision

aasabatini — Tue, 25 May 2021 07:20:49 GMT

index= <your index> | stats values(_indextime) as indextime by _raw | convert ctime(indextime)

Re: File Comparision

akankshayadav — Tue, 25 May 2021 10:28:40 GMT

This solution gives _raw present in all the versions. Not the event which is different.

Re: File Comparision

aasabatini — Tue, 25 May 2021 13:15:41 GMT

ok now you can expand your indextime field

index= <your index> | stats values(_indextime) as indextime by _raw | convert ctime(indextime) | mvexpand idextime | table idextime _raw