Splunk - Diff examples and One-Way diff
Splunk’s ‘set’ command will allow you to ‘diff’ two result sets. What this means is that say you have two sets:
Set A: “event1 event2 event3”
Set B: “event2 event3 event4”
Splunk will tell you all the differences that occur between these two sets. When you run the following command, the output will be “event1 event4” because they are not common in both sets.
| set diff [set A] [set B]
A full splunk search search to generate the following example might look like:
| set diff
[| makeresults | eval events=“event1 event2 event3” | makemv events | mvexpand events | table events]
[| makeresults | eval events=“event2 event3 event4” | makemv events | mvexpand events | table events]
This would be considered a two-way diff. It can be very useful for determining that there are events from both sets (search results) that can’t be found in the opposite set.
To break down the commands
Continue reading →