topic Re: fschange pollPeriod parameter in Getting Data In

fschange pollPeriod parameter

kkuminsky — Mon, 14 Jun 2010 19:40:59 GMT

If I specify pollPeriod parameter for fschange, is it supposed to generate an event each time it checks file for changes or only if it checks and finds that the file was changed?

I monitor for changes separate files as well as folders. Is pollPeriod supposed to work for separate file monitoring also or for folder monitoring only?

Re: fschange pollPeriod parameter

the_wolverine — Tue, 15 Jun 2010 01:10:31 GMT

The pollPeriod setting only determines how often Splunk will check to see whether the monitored configuration file has changed.

The expected behavior is that an event will be created ONLY when there is a change detected.

Re: fschange pollPeriod parameter

kkuminsky — Tue, 15 Jun 2010 01:37:57 GMT

Thank you for the answer. I would expect such behavior too, but that's not what I'm getting.

Please, see the following post with some details: http://answers.splunk.com/questions/3609/fschange-file-monitoring/3626#3626 ("fschange file monitoring")