How to validate the data before and after the migration?

[LearningGuy]

Let's say I have a database that is pulled from an application on a daily basis into Splunk and accessed via DBXquery.
Sometimes there are some changes in the data that might be caused by the system migration, including the number of fields, the number of rows, the order of the fields, etc.
How do I validate the data before and after the migration to make sure there are no discrepancies?

I am thinking of creating a query to display the fields and number of rows and compare them before and after.
Please suggest.
Thank you so much.

[bowesmana]

Something like

index=your_index earliest=-1d@d latest=now
| eval day=if(_time>=relative_time(now(), "@d"), "today", "yesterday")
| eval fieldcount = 0
| foreach * [ eval fieldcount=fieldcount+1 ]
| stats count max(fieldcount) as fieldcount by day

will give you event count and field count per day, but not totally sure if the foreach will count correctly for fieldcount and it will very much depend on your data whether this is suitable or not.

This assumes you ingest the data both yesterday and today.

But there are many open area 

- what's the relevance of field order - there's not concept of field order in Splunk

- what if new rows are added or removed 'today', what do you want to see