Splunk Search

Monitoring external config files for difference in content from its previously indexed version.

mrkumar
New Member

Hi,

I have a config file collected across a bunch of hosts. I started off with indexing the file as a single entry. I am trying to use Splunk to monitor any difference in the content of a file from its previously indexed version. Now that I have the various versions of the same file I need to use either diff or | set diff command to obtain the difference in the content of the file for each host. I am unable to include group by host in the diff or |set diff queries to obtain the difference in contents of the file per host.

Any suggestions on how to implement this search will be appreciated.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You could try to use fschange for this function, although it is a deprecated feature, it still sits in the code and will allow you to make before and after comparisons to your files.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...