Splunk Search
Highlighted

compare linecount for files

Communicator

I am using splunk to compare the output of routes from a list of firewalls. The output contains a listing of routes. I would like to compare the linecount from each pair member to make sure that the routes are added to each firewall properly.

I have field called cluster that associates the pair members (host)

host1-p,host1
host1-b,host1

I have a few hundred of these files to compare. I would like to build a view that shows the listing of cluster or hosts where the linecount is not the same between cluster members.

I will use that to investigate further. I can get the files into splunk and into an index.

How can I compare (subtract linecounts and if sum is non-0 show) the latest output for each cluster?

This gets me the data to compare

index=fw_audits eventtype=routes earliest=-14d | table cluster,host,linecount

Any thoughts how to do the compare between cluster members?

0 Karma
Highlighted

Re: compare linecount for files

Communicator

solved using the range() operator

View solution in original post

0 Karma