https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-syntax-to-have-fschange-search-multiple/m-p/84643#M17591 <P>Will the following work:</P> <P>[fschange:C:\Program Files\progam|D:\File\group]</P> <P>Should replace "|" with "OR",or should i use "&amp;" or "AND". I am trying to monitor file changes to multiple directories using a single fschange statement. I would prefer to not use multiple fschange statements requiring changes to the same attributes for each fschange. If boolean logic cannot be used, is there a way to use a function to define the attributes for fschange?</P> Tue, 09 Oct 2012 15:09:11 GMT nick085 2012-10-09T15:09:11Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-syntax-to-have-fschange-search-multiple/m-p/84643#M17591 <P>Will the following work:</P> <P>[fschange:C:\Program Files\progam|D:\File\group]</P> <P>Should replace "|" with "OR",or should i use "&amp;" or "AND". I am trying to monitor file changes to multiple directories using a single fschange statement. I would prefer to not use multiple fschange statements requiring changes to the same attributes for each fschange. If boolean logic cannot be used, is there a way to use a function to define the attributes for fschange?</P> Tue, 09 Oct 2012 15:09:11 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-syntax-to-have-fschange-search-multiple/m-p/84643#M17591 nick085 2012-10-09T15:09:11Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-syntax-to-have-fschange-search-multiple/m-p/84644#M17592 <P>I am sorry, but I dont believe Splunks allows you to perform boolean logic. If you like to use a single fschange entry will most likely have to use File system monitoring filters. </P> <P><CODE></CODE><PRE><CODE><BR /> [fschange:/etc] <BR /> filters = nothis,dothis <BR /> [filter:blacklist:nothis] <BR /> regex1 = .*bak<BR /> regex2 = .*bk<BR /> [filter:whitelist:dothis] <BR /> regex1 = .<EM>\.c <BR /> regex2 = .</EM>\.h <BR /> </CODE></PRE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Data/Monitorchangestoyourfilesystem">Using FSchange</A></P> Tue, 09 Oct 2012 16:27:06 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-syntax-to-have-fschange-search-multiple/m-p/84644#M17592 bmacias84 2012-10-09T16:27:06Z