How do I compare two log files in PowerBI?

Comparing two log files in Power BI (for example, comparing a "Healthy" agent's logs to a "Failing" agent's logs, or comparing logs from before and after a configuration change) is one of the most powerful uses of the tool.

To do this effectively, you need to be able to view them side-by-side or overlaid on the same timeline.

1. The Setup: Add a "Category" Column

When you ingest the 2 files, you must ensure Power BI knows which is which.

If using the Folder Connector: Power BI automatically provides the Source.Name column. Use this as your "Category."
If importing files individually: Manually add a custom column to each table (for example, Status = "Healthy" for one and Status = "Failing" for the other) before you append them together.

2. The "Side-by-Side" Timeline (Area or Line Chart)

This is the best way to see when the two files started to behave differently.

Axis: Timestamp (Grouped by Minute or Hour).
Values: Count of Rows (or Count of Errors).
Legend: Source.Name (or your "Category" column).
What to look for: Look for the point where the "Failing" line spikes or flatlines while the "Healthy" line continues normally. This identifies the exact moment of divergence.

3. The "Error Profile" Comparison (Clustered Bar Chart)

This helps you see if the types of errors are different between the two files.

Y-Axis: Message (The parsed log message).
X-Axis: Count of Rows.
Legend: Source.Name.
What to look for: If the "Failing" log has 500 "Socket Timeout" errors and the "Healthy" log has 0, you have found your smoking gun.

4. The "Delta" View (Matrix Table)

A Matrix is the best way to see a direct count comparison of events.

Rows: Message (The log text).
Columns: Source.Name.
Values: Count of Message.
Why it works: This creates a spreadsheet-style view where you can see:
- Message A: File 1 (10 times) | File 2 (12 times) — Normal
- Message B: File 1 (0 times) | File 2 (450 times) — Critical Difference

5. Time-Shifting (Advanced)

If you are comparing two scans that happened at different times (for example, a scan on Monday vs. a scan on Tuesday), the timestamps won't line up on a chart.

The Fix: Create a "Relative Time" column in Power Query.
How: Calculate the time elapsed since the "Scan Started" marker for each file.
Result: You can now overlay the two scans on a chart starting at "Minute 0," allowing you to compare their performance second-for-second regardless of when they actually ran.

SME Comparison Checklist

Comparison Goal	Best Visual	Key Metric
When did it break?	Line Chart	Count of Errors over Time
What is the difference?	Clustered Bar Chart	Top Error Messages by File
Is one slower?	Gantt or Bar Chart	Time between "Start" and "End" markers
Direct count check	Matrix Table	Count of specific events per file

Summary: To compare two logs, Append them into a single table, keep a Source Name column to distinguish them, and use Clustered Bar Charts or Matrix Tables to highlight the differences in error types and frequency.