topic Re: Tracking if file size is 0 bytes 30 seconds after creation in Splunk Dev

Tracking if file size is 0 bytes 30 seconds after creation

suhanrs — Wed, 01 Aug 2018 09:43:03 GMT

How to track if file size is 0 bytes 30 seconds after creation. Can anyone help me with this?

Thank you very much.

Re: Tracking if file size is 0 bytes 30 seconds after creation

skoelpin — Wed, 01 Aug 2018 15:27:50 GMT

This can be done with some conditional logic.

This assumes you have a filed called Creation_time which is in seconds AND have a field called bytes

| eval Creation_time_plus_thirty='Creation_time'+30
| eval time_after_creation=if(_time>'Creation_time_plus_thirty',1,0)
| eval ALERT=if(time_after_creation=1 AND bytes=0,"ALERT","GOOD")
| search ALERT="ALERT"

Re: Tracking if file size is 0 bytes 30 seconds after creation

suhanrs — Thu, 02 Aug 2018 03:01:22 GMT

Thank you for your help.
But what search command do I have to use to get the file size if there is no field called bytes?

Re: Tracking if file size is 0 bytes 30 seconds after creation

skoelpin — Thu, 02 Aug 2018 13:30:03 GMT

How are you currently calculating bytes? Do you have a GB, MB, or KB field?

Re: Tracking if file size is 0 bytes 30 seconds after creation

suhanrs — Fri, 03 Aug 2018 03:39:47 GMT

No, there is no any field called bytes but I need to monitor the file size of a particular path.

I have tried with fschange stanza in inputs but it throws an error;
FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time

How can I solve this?

Re: Tracking if file size is 0 bytes 30 seconds after creation

skoelpin — Fri, 03 Aug 2018 13:43:21 GMT

Then how do you plan on doing this if you aren't monitoring the byte size? You should strongly consider these details before asking questions on here and wasting time