https://community.splunk.com/t5/Getting-Data-In/How-does-fschange-poll/m-p/83608#M17387 <P>Hi,</P> <P>I am trying to determine the impact of using fschange on a large number of files.</P> <P>Does Splunk check the time stamp of each and every file in the subdirectory with every poll interval or does Splunk register callback functions with the OS for changes to the directory or files?</P> <P>thx</P> <P>Joon</P> Thu, 04 Nov 2010 19:05:11 GMT joonradley 2010-11-04T19:05:11Z https://community.splunk.com/t5/Getting-Data-In/How-does-fschange-poll/m-p/83608#M17387 <P>Hi,</P> <P>I am trying to determine the impact of using fschange on a large number of files.</P> <P>Does Splunk check the time stamp of each and every file in the subdirectory with every poll interval or does Splunk register callback functions with the OS for changes to the directory or files?</P> <P>thx</P> <P>Joon</P> Thu, 04 Nov 2010 19:05:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-fschange-poll/m-p/83608#M17387 joonradley 2010-11-04T19:05:11Z https://community.splunk.com/t5/Getting-Data-In/How-does-fschange-poll/m-p/83609#M17388 <P>To my knowledge, Splunk does not (currently, as of 4.2) register with any filesystem event API. You should pretty much count on polling. Not all platforms have these APIs, and the APIs vary greatly from platform to platform. </P> <P>It's possible that Splunk (the company) has these types of improvements to fschange in their roadmap/plan. You should submit an enhancement request to help raise the importance of such changes within the product.</P> Sun, 30 Oct 2011 00:20:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-does-fschange-poll/m-p/83609#M17388 dwaddle 2011-10-30T00:20:57Z