Recommendation for "diff" view between multiline events

[Justin_Grant]

I have two multiline events (they are stuffed with the contents of two versions of a config file) and I'd like a good way to show a view which allows users to examine where the events are different (besides time and/or host, which will of course be different).

Is this kind of view easy to build with Splunk, and if so how would I build it?

Ideally this would be a side-by-side differences view like you can see in TortoiseMerge, WinDiff, or a similar tool. But I'd be happy with something lower-end too (e.g. just a text output listing the differences without any side-by-side UI).

[parallaxed]

Following on from gkanapathy's comments, this seems easy to build into a view. Sounds like you need simple form or EventsViewer module (or similar), that does something akin to this:

source=/my/config/file | head 2 | diff

This is assuming you want to use the baked-in diff.

You will need to check out some external tools (i.e. GNU diff) if you want to generate a side-by-side look (diff -y or similar) - this could be a scripted input that searches for both events, diffs them, and puts the result back into Splunk through a file or a nifty TCP input - whatever suits.

Seems a bit round the houses, but it's probably better than fiddling with Splunk internals to provide it.

[gkanapathy]

Yeah. Probably doable with a scripted input. Current diff is a Python script that uses the Python diff library, and it seems to have some way to generate side-by-side diffs, but it doesn't seem that easy. The regular Unix command line diff can do it though.