How to Compare upgraded app version configurations with the old one in order to avoid the parsing issues

[493600]

Looking for a solution that does certain validations check when we upgrade any splunk addon to latest version.

This is to make sure when the addon is upgraded to latest version it does not break any of the existing working configs like field parsing, search execution time, etc. in prod.

So we need to check if its possible to create a dashboard or something where in we can compare the old state vs upgraded state of the addon before we deploy to prod.

Basic two validations can be CIM fields & search execution time and to kick off this we can pick any one sourcetype.

[meetmshah]

Hello @493600, There is no OOTB of achieving this. Usually, we have to download the events in _raw format, upload it on a test environment which has latest version of TA along with CIM Validator installed - and validate the field extraction.

Commands like fieldsummary can help in comparing the field name and values - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldsummary

Please accept the solution and hit Karma, if this helps!