Hello, I have the following dataset. It consists of configuration parameters from multiple systems. Each system has somewhere in the neighborhood of 3000-5000 parameters, some of which will not exist in all systems. I am trying to come up with a list of unique combinations of parameters with an Matching flag which shows whether the value is identical between both systems. It should indicate a false flag if the parameter exists in either system, but not the other, or if the parameter exists in both systems but with different values.
The parameters are identified by a unique combination of SERVICE_NAME, FILE_NAME, SECTION and KEY (all four are required to be the same). And the system is identified by SID. The data look like this:
SID | SERVICE_NAME | FILE_NAME | SECTION | KEY | VALUE |
AAA | index | global.ini | global | timezone_dataset | 123 |
AAA | dpserver | index.ini | password policy | minimal_password_length | 16 |
AAA | index | index.ini | flexible_table | reclaim_interval | 3600 |
AAA | dpserver | global.ini | abstract_sql_plan | max_count | 1000000 |
BBB | dpserver | index.ini | password policy | minimal_password_length | 16 |
BBB | index | index.ini | password policy | minimal_password_length | 25 |
BBB | dpserver | global.ini | abstract_sql_plan | max_count | 1000000 |
BBB | index | index.ini | mergedog | check_interval | 60000 |
The data is in a dashboard, along with drop-downs to select two systems to be compared. One a user selects system AAA and system BBB, I would like the result to show:
SERVICE_NAME | FILE_NAME | SECTION | KEY | Match |
index | global.ini | global | timezone_dataset | No |
dpserver | index.ini | password policy | minimal_password_length | Yes |
index | index.ini | flexible_table | reclaim_interval | No |
dpserver | global.ini | abstract_sql_plan | max_count | Yes |
index | index.ini | password policy | minimal_password_length | No |
index | index.ini | mergedog | check_interval | No |
I have tried many different SPL searches, but none have provided the intended result.
I would greatly appreciate any assistance or guidance.
Cheers,
David
| stats values(SID) as SID values(VALUE) as VALUE by SERVICE_NAME FILE_NAME SECTION KEY
| eval match=if(mvcount(SID) = 2 AND mvcount(VALUE) = 1,"Yes", "No")
Wow, that was a lot simpler than the solutions I was trying to get working. Thank you!
| stats values(SID) as SID values(VALUE) as VALUE by SERVICE_NAME FILE_NAME SECTION KEY
| eval match=if(mvcount(SID) = 2 AND mvcount(VALUE) = 1,"Yes", "No")