Splunk App - sdiff