topic only monitor FILE NAME not Content in Getting Data In

only monitor FILE NAME not Content

hoggjade — Thu, 04 Aug 2011 10:59:22 GMT

Good day

is it possible to only monitor FILE NAMES within a Directory and sub directories and not the Content of these files

Reason being, I need to have a Logging system that users can monitor if a File has been received, but they do not need to see the content

also it needs to read as Simply as possible

Re: only monitor FILE NAME not Content

mw — Thu, 04 Aug 2011 13:52:17 GMT

You can configure an fschange input stanza to monitor changes to the directory. That would probably be the easiest. Look for "fschange" on this page: http://www.splunk.com/base/Documentation/latest/admin/Inputsconf

Re: only monitor FILE NAME not Content

cpt12tech — Mon, 21 Mar 2016 22:30:09 GMT

I have a similar need, I want to list all the files on a volume. These are large video files and I need a list of what is on the volume for reconciliation and searching. One way to set this up is create a Windows .bat file and schedule it to run. The script outputs to a text file. Then configure splunk to monitor the text file. Here is the .bat script:
dir e:\someFolderName*.* /b >>e:\fileNameForSplunkToMonitor.txt

fschange is being depriciated and splunk uses Windows security audit. This would be too cumbersome for my needs as I would have to search for all files added & deleted to get the current inventory.