https://community.splunk.com/t5/Splunk-Search/Comparison-of-logs/m-p/25802#M4903 <P>You can use <CODE>timewrap</CODE> for this:<BR /> <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Sat, 30 May 2015 17:23:35 GMT woodcock 2015-05-30T17:23:35Z https://community.splunk.com/t5/Splunk-Search/Comparison-of-logs/m-p/25801#M4902 <P>Pretty new to this - Is there a way to compare log results between two timeframes ? Consider the following scenario <BR /> 1) The web app is working great, however there is noise in the logs around issues that are expected due to current design.<BR /> 2) An outage happens</P> <P>The development team wants to quickly identify the diff in logs between now and say 2 hrs before the outage. I assume i could provide a custom search query that would exclude the noise(once we identify every single one of them <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ) but would be great if there is a way to do a diff.</P> Thu, 01 Dec 2011 00:28:54 GMT https://community.splunk.com/t5/Splunk-Search/Comparison-of-logs/m-p/25801#M4902 maheshh 2011-12-01T00:28:54Z https://community.splunk.com/t5/Splunk-Search/Comparison-of-logs/m-p/25802#M4903 <P>You can use <CODE>timewrap</CODE> for this:<BR /> <A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Sat, 30 May 2015 17:23:35 GMT https://community.splunk.com/t5/Splunk-Search/Comparison-of-logs/m-p/25802#M4903 woodcock 2015-05-30T17:23:35Z