I am using splunk to compare the output of routes from a list of firewalls. The output contains a listing of routes. I would like to compare the linecount from each pair member to make sure that the routes are added to each firewall properly.
I have field called cluster that associates the pair members (host)
I have a few hundred of these files to compare. I would like to build a view that shows the listing of cluster or hosts where the linecount is not the same between cluster members.
I will use that to investigate further. I can get the files into splunk and into an index.
How can I compare (subtract linecounts and if sum is non-0 show) the latest output for each cluster?