Compare github repos using splunk?

[karthi2809]

Hi ,

Thanks in Advance,

We have requirement that the  two github repos are in two (eg: USA and Canada)different country.so every day we replicate code. The monitoring script would be created, which will compare the USA and Canada repositories. This script will be executed as part of code replication pipelines. The comparison result generated by script, would be saved in a log file. This log file would then be sent to Splunk using Splunk Forwarder. . Alerts would be created in Splunk to send automated email. These alerts would get triggered if any differences are identified b/w the repositories based on the log data sent to Splunk.

Is there any way to compare two repos using splunk app directly

[Azeemering]

Yes it seems possible.

I have built a similar app that check if a github app is set to public by accident using the github api. You can create an app that polls the api and ingests any changes in the repo.
You could apply the same priniciple by ingesting both repos and create a compare search in Splunk.

[pavanbits1990]

Splunk Phantom also uses a Git repository to publish company-authored playbooks for customers to download. This repository is called the community repository and is configured on Splunk Phantom by default.

[VatsalJagani]

@karthi2809 - I think what you are currently doing with the script is more appropriate architecturely.

Even if you were to do it in Splunk, I would have suggested doing it in module input's python and you end up doing the same thing. You can do this if you want. It's basically the same thing as what you are doing today.

I hope this helps!!!

[richgalloway · Accepted solution]

Splunk does not have a native interface to Git/github.  You could, however, set up a scripted input that compares the two repositories and reports on the differences found.  The output of that script would be indexed automatically by Splunk, eliminating the need for a log file and a forwarder.  Once the data is ingested then searches can be run to potentially trigger alerts.

[karthi2809]

How it will send the data automatically?

[richgalloway]

It's Splunk magic.  😉  Anything a scripted or modular input writes to stdout is saved in an index.