How to find difference in JSON file as in given below?

[karthi2809]

Hi,

Thanks in advance

Below events is in splunk .We have two repos in git 1. AAA 2.BBB.When ever the repos will replicate and both repos should be same file. But in my case after replicate both repos files are missing so i should compare the files and whare are the files is missing and send an alert as difference in repos.

INTERESTING FIELDS:

CODE.Modified_files{}

TOOLKIT.Modified_files{}

Expected output after comparing:

CODE.Modified_files{}

"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master",
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json"

TOOLKIT.Modified_files{}

"a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master"

These files are only present in AAA repo but not in BBB. So we need compare both AAA and BBB missing files. As per the event and show the difference.

{
  "CODE": {
    "modified_files": [
      "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/HEAD", 
      "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/config", 
      "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/HEAD", 
	  "a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/config",
	  "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master",
	  "a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json"
	  ]
	  }
	}
	{
  "TOOlKIT": {
    "modified_files": [
      "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/HEAD", 
      "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/config", 
      "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/HEAD", 
	  "a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/config",
	  "a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master", 
	  ]
	}
}

[ITWhisperer]

Assuming each event covers one repository and has a field called json with the files

| spath input=json
| foreach *.modified_files{}
    [| eval repo=if(isnotnull('<<FIELD>>'),"<<MATCHSEG1>>",repo)
    | eval modified_files=if(isnotnull('<<FIELD>>'),'<<FIELD>>',modified_files)]
| fields - *.modified_files{}
| eval modified_files=mvmap(modified_files,replace(modified_files,"AAA_".repo,"repo"))
| eval modified_files=mvmap(modified_files,replace(modified_files,"BBB_".repo,"repo"))
| streamstats count as row
| stats values(json) as json count by row modified_files
| where count = 1
| stats values(modified_files) as modified_files values(json) as json by row