Looking out for the alternatives of logcompare in Splunk as provided by SumoLogic.
For better understanding, this is what logcompare (in sumologic) does internally:
- Create the signatures by clustering messages together based on string and pattern similarity within a time range(say last 15mins) as provided.
- Compare the signatures based on the timeshift(say for example compares the logs for last 15 mins with similar 15 min time range before 24 hours from now). And provides the following stats for every signature(or we can say for every cluster in Splunk terminology) created:
-> Error Count (within timerange)
-> What is the delta percentage (change in number of messages) for a particular signature
-> If the kind of an error is new or not.
I wanted to know if it's possible to create Splunk queries to achieve the same.
