topic Re: How to compare multiple files by diff command in search? in Splunk Search

How to compare multiple files by diff command in search?

sunrise — Fri, 08 Feb 2013 09:48:10 GMT

I have a question about diff command in search.

Of course though, a diff command compares two files,
I want to compare multiple files.
For example, when three configuration files (a.conf, b.conf, c.conf) were put into an indexer,
I want to compare those files at one search like below.

Compare a.conf with b.conf
Compare a.conf with c.conf
Displays the each differences

Can we loop the command by reading the list file?
Any idea anyone?

Thank you.

Re: How to compare multiple files by diff command in search?

dart — Tue, 12 Feb 2013 00:37:09 GMT

The presentation is not the best, but this does what you want:

index=_internal | head 3 | appendpipe [diff pos1=1 pos2=2 | eval diff = _raw]  | appendpipe [diff pos1=1 pos2=3 | eval diff= _raw] | stats values(diff)

Re: How to compare multiple files by diff command in search?

sunrise — Thu, 14 Feb 2013 03:46:44 GMT

Thank you dart for helping me.
I'll try it.

Re: How to compare multiple files by diff command in search?

Rob — Thu, 13 Mar 2014 05:30:26 GMT

From the class

s=a OR s=b |stats count values(source) BY _raw, lineNum |search (count=1 source!=a) OR (count=2 source!=a)