topic Re: How to compare search result of logs from production server to QA search result logs? in Splunk Search

How to compare search result of logs from production server to QA search result logs?

raghavendrasred — Fri, 02 Oct 2015 14:13:59 GMT

I want compare the 2 search result error logs and show the result.
I want to compare based on "Error" log of 2 search result.

One search result from prod:

*NullPointerException*  index=prod | search log_level="ERROR" OR log_severity="Error" OR status>399 | stats earliest(_time) as FirstOccurence latest(_time) as LastOccurence count by static_msg | fieldformat FirstOccurence=strftime(FirstOccurence,"%m/%d/%y %H:%M:%S") | fieldformat LastOccurence =strftime(LastOccurence,"%m/%d/%y %H:%M:%S") | eval Error = static_msg | Table Error  count FirstOccurence LastOccurence | sort –count

Search result from QA:

*NullPointerException*  host=$host$ | search log_level="ERROR" OR log_severity="Error" OR status&gt;399 | stats earliest(_time) as FirstOccurence latest(_time) as LastOccurence count by static_msg | fieldformat FirstOccurence=strftime(FirstOccurence,"%m/%d/%y %H:%M:%S") | fieldformat LastOccurence =strftime(LastOccurence,"%m/%d/%y %H:%M:%S") | eval Error = static_msg | Table Error  count FirstOccurence LastOccurence | sort –count

I tried diff like eval diff = prod - qa it's showing difference of count or number of entries displayed, but I am looking for actual log differences.

Re: How to compare search result of logs from production server to QA search result logs?

raghavendrasred — Fri, 09 Oct 2015 20:24:44 GMT

Please some one answer the above request.

Re: How to compare search result of logs from production server to QA search result logs?

somesoni2 — Fri, 09 Oct 2015 20:41:02 GMT

Try something like this

| set diff [search *NullPointerException*  index=prod log_level="ERROR" OR log_severity="Error" OR status>399 | stats earliest(_time) as FirstOccurence latest(_time) as LastOccurence count by static_msg | convert ctime(*Occurrence) timeformat="%m/%d/%y %H:%M:%S" | rename  static_msg as Error| Table Error  count FirstOccurence LastOccurence] [search *NullPointerException* host=$host$ log_level="ERROR" OR log_severity="Error" OR status>399 | stats earliest(_time) as FirstOccurence latest(_time) as LastOccurence count by static_msg | convert ctime(*Occurrence) timeformat="%m/%d/%y %H:%M:%S" | rename  static_msg as Error| Table Error  count FirstOccurence LastOccurence ] | sort –count

Re: How to compare search result of logs from production server to QA search result logs?

raghavendrasred — Tue, 29 Sep 2020 07:32:44 GMT

it not worked.

I tried another way..

it should work like vlookup, but it is not working..

Re: How to compare search result of logs from production server to QA search result logs?

raghavendrasred — Mon, 12 Oct 2015 16:58:18 GMT

Thanks. now i got the result in single Error field.
in result we have both the records of production and QA in single field as Error. The Error contains the 2 records with same message(like 2 entry with message "Failed to process ospp message."). Is it possible to highlight common records present in result.