Hi,
Thanks in advance
Below events is in splunk .We have two repos in git 1. AAA 2.BBB.When ever the repos will replicate and both repos should be same file. But in my case after replicate both repos files are missing so i should compare the files and whare are the files is missing and send an alert as difference in repos.
CODE.Modified_files{}
TOOLKIT.Modified_files{}
Expected output after comparing:
CODE.Modified_files{}
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master",
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json"
TOOLKIT.Modified_files{}
"a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master"
These files are only present in AAA repo but not in BBB. So we need compare both AAA and BBB missing files. As per the event and show the difference.
{
"CODE": {
"modified_files": [
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/HEAD",
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/config",
"a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/HEAD",
"a/D:\\\\splunk_code_replication\\\\BBB_CODE/.git/config",
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/logs/refs/heads/master",
"a/D:\\\\splunk_code_replication\\\\AAA_CODE/.git/version.json"
]
}
}
{
"TOOlKIT": {
"modified_files": [
"a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/HEAD",
"a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/config",
"a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/HEAD",
"a/D:\\\\splunk_code_replication\\\\BBB_TOOLKIT/.git/config",
"a/D:\\\\splunk_code_replication\\\\AAA_TOOLKIT/.git/logs/refs/heads/master",
]
}
}
Assuming each event covers one repository and has a field called json with the files
| spath input=json
| foreach *.modified_files{}
[| eval repo=if(isnotnull('<<FIELD>>'),"<<MATCHSEG1>>",repo)
| eval modified_files=if(isnotnull('<<FIELD>>'),'<<FIELD>>',modified_files)]
| fields - *.modified_files{}
| eval modified_files=mvmap(modified_files,replace(modified_files,"AAA_".repo,"repo"))
| eval modified_files=mvmap(modified_files,replace(modified_files,"BBB_".repo,"repo"))
| streamstats count as row
| stats values(json) as json count by row modified_files
| where count = 1
| stats values(modified_files) as modified_files values(json) as json by row