Splunk Search

Comparison of logs?

maheshh
New Member

Pretty new to this - Is there a way to compare log results between two timeframes ? Consider the following scenario
1) The web app is working great, however there is noise in the logs around issues that are expected due to current design.
2) An outage happens

The development team wants to quickly identify the diff in logs between now and say 2 hrs before the outage. I assume i could provide a custom search query that would exclude the noise(once we identify every single one of them 🙂 ) but would be great if there is a way to do a diff.

Tags (1)
0 Karma

woodcock
Esteemed Legend

You can use timewrap for this:
https://splunkbase.splunk.com/app/1645/

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...