topic Monitor files in a directory in Getting Data In

Monitor files in a directory

Wilson — Fri, 04 Jul 2014 05:23:40 GMT

Is there anyway for Splunk to monitor files in a directory? I do not need the content of the files to be analysis (since it is not a log file) but more to list new files in a directory.

The specific scenario is that I am creating a operation monitoring dashboard. One of the panel will contain random documents which contains security alerts from various sources. The format of the file could be PDF, random text in a text file, email etc - which they do not have a structure format. It is not an XML feed from external. I want to make the operations team aware that an alert come it from authoritative source for further analysis.

What will be the best way to do that? Thank you in advance for your input.

Re: Monitor files in a directory

datasearchninja — Fri, 04 Jul 2014 05:53:10 GMT

I'd suggest the 'script' type input.

1) Write a short shell script that prints the data and time and then lists the contents of the directory. Put this script in the ./bin dir of the app.
2) In inputs.conf use the 'script' type input to run the script on a regular basis with the 'interval' param.
3) In splunk search you could then check for differences in the output.

Re: Monitor files in a directory

Wilson — Fri, 04 Jul 2014 05:55:29 GMT

Thank you Colin. I will give this a go.