Monitoring external config files for difference in content from its previously indexed version.

[mrkumar]

Hi,

I have a config file collected across a bunch of hosts. I started off with indexing the file as a single entry. I am trying to use Splunk to monitor any difference in the content of a file from its previously indexed version. Now that I have the various versions of the same file I need to use either diff or | set diff command to obtain the difference in the content of the file for each host. I am unable to include group by host in the diff or |set diff queries to obtain the difference in contents of the file per host.

Any suggestions on how to implement this search will be appreciated.

[jbsplunk]

You could try to use fschange for this function, although it is a deprecated feature, it still sits in the code and will allow you to make before and after comparisons to your files.