Compare and show the difference of two events

[Patrick91]

Hello Splunkers,

I'm very new to Splunk and I cannot seem to get the data that I want.

I want to perform a search that compares 2 events. The events have the same field "Severity".
I want the search result showing me what the difference is between the 2 events. If it is possible showing me what lines are different

The events are coming form 2 different hosts but in the same index. The events are almost identical but there are some differences.

Here is an example of a event:
5593CF4E.0000-13: .cpp,336,"setError")
+5593CF4E.0000 Error Type= CTX_MetafileNotfound

+5593CF4E.0000 Severity= CTX_Warning

+5593CF4E.0000 Native Error Code = 0

+5593CF4E.0000 SQL State= NULL

+5593CF4E.0000 Reason Code= 0

+5593CF4E.0000 executing: openMetaFile
(5593CF4E.0001-13:khdxbase.cpp,339,"setError")
+5593CF4E.0001 ERROR MESSAGE: "Unable to open Metafile *

[woodcock · Accepted solution]

This should work (assuming you have field extractions working:

... | stats dc(*) AS DC_* values(*) AS * by Severity | foreach DC_* [eval <<MATCHSTR>> = if((<<FIELD>> > 1), <<MATCHSTR>>, null())] | fields - DC_*

[Patrick91]

It did not seem to work. But I tried it with _raw instead of Severity and it seemed to work. So I guess my field extraction did not work.

I tried it by selecting an event and then selecting the Severity but I get this massage:
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

So I tried it using settings > Fields > new. But i guess the extraction is not working.

Any tips on how to get this working for the above Severity?

Edit:
The field extraction seemed to work with the following:
(?i)Severity= (?P"<"Severity">"(?:[^”]+))

[Patrick91]

Ok, so I get the outcome of the search. That's Good 🙂

As a check to see if I understand the search correctly.

The events that are part of the field Severity are being matched on all known fields.
If the 2 events have the same field present it returns a 1 and when a field is present on one event but not the other event it gets a 0. Right?

[woodcock]

The way it works is that you are doing a left-join with field Severity such that only events that contain (a non-NULL value for) Severity are kept. The values(*) makes the join keep all fields from both events and if the fields are the same in each event (for a matching Severity) a multi-value field will be created. The number of distinctly different values for each field is captured with the dc(*); in your case, this will always be a 1 or a 2. The last stage iterates over every DC* field and if the value is >1 then this field is a mutli-value field which means one value came from each event so we keep it, otherwise we set the value to null and it disappears in the final results.