Splunk Base : SplunkAdministration : #3401

Comparing two files

CerielTjuh — Thu, 15 Oct 2009 03:26:01 PDT

Thnx worked like a charm!

Comparing two files

araitz — Wed, 14 Oct 2009 07:36:20 PDT

Sure! Let's assume today's file is export1014.txt and yesterday's file was export1013.txt.

You need to configure Splunk to index the entire file as one event, so in props.conf you would configure something like this:

[source::.../export*.txt]
DATETIME_CONFIG=CURRENT
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=somethingwhichshouldneverappearinaneventxyz123

Once splunk indexes the file as such, you can just use the diff command as I mentioned above:

source=*export1013.txt OR source=*export1014.txt | diff

Comparing two files

CerielTjuh — Wed, 14 Oct 2009 01:46:35 PDT

Hi araitz,

Let me explain the situation, Novell reports all trustees every night in a txt file:

"TRUSTEE","SYS:\Icon","LONG","[Root]","RF"
"TRUSTEE","SYS:\JAVA","LONG","SRV.AZL","RF"
"TRUSTEE","SYS:\LOGIN","LONG","[Public]","RF"

I index these files every night and want to compare the results with Splunk, is this even possible?

Thnx in advance!

Comparing two files

araitz — Fri, 09 Oct 2009 08:08:04 PDT

Sure, the unix "diff" command :)

Splunk "diff" will only compare two search results, so you should index both the files, and then you can use diff:


source=E:\test\3.log OR source=E:\test\1.log | diff

Comparing two files

CerielTjuh — Fri, 09 Oct 2009 07:31:36 PDT

Is there a possibility to compare two files? :)

Comparing two files

araitz — Fri, 09 Oct 2009 06:28:45 PDT

I don't think you are using the diff command correctly, as it isn't intended to take a file as an argument. Rather it is designed to show the difference between two search results:

http://www.splunk.com/base/Documentation/latest/SearchReference/Diff

Let me know if I am missing something.

Comparing two files

CerielTjuh — Fri, 09 Oct 2009 05:44:01 PDT

Hi there,

After trying some time, I was not able to compare two files:

| file E:\test\3.log | diff E:\test\1.log

1.log
username=aa username=bb

3.log
username=aa username=cc username=bb

This is what I get:

-username=aa
+username=cc

Platform: Windows 2008 Server (32bit)
Splunk: 4.0.4.

Hope you can help