topic Re: how to count the number of files and directories in a folder in splunk in Getting Data In

how to count the number of files and directories in a folder in splunk

Afef — Wed, 13 Aug 2014 11:26:13 GMT

Hi,
Please Could someone tell me how to count the number of files and directories in a folder in splunk ?
Regards

Re: how to count the number of files and directories in a folder in splunk

martin_mueller — Wed, 13 Aug 2014 11:37:54 GMT

Are you trying to index that count for some directory, or are you trying to calculate statistics based on already indexed data and the path in their source field?

Re: how to count the number of files and directories in a folder in splunk

Afef — Wed, 13 Aug 2014 11:58:13 GMT

I want just to calculate the number of directories and files in a specific folder ! so if it is possible to not index data it will be good. If not i want to have the count and create a dashboard like that :

DIRECTORY NumberOfFiles NumberOfDirectories
Dir Name NBFiles NBDir

So How could i do this ?

Regards

Re: how to count the number of files and directories in a folder in splunk

martin_mueller — Wed, 13 Aug 2014 12:49:55 GMT

You could create a script that computes the counts you're looking for, a naïve one-liner counting the files and directories in a path could be this:

cd /path/to/count; date; pwd; ls | wc -l

Then configure that as a scripted input in your Splunk.

Re: how to count the number of files and directories in a folder in splunk

smudge797 — Wed, 13 Aug 2014 13:03:43 GMT

Can you expand on the "Then configure that as a scripted input in your Splunk." Thanks!

Re: how to count the number of files and directories in a folder in splunk

martin_mueller — Wed, 13 Aug 2014 13:15:48 GMT

Sure. Say you saved my one-liner or your much better script to $SPLUNK_HOME/etc/apps/your_app/bin/dircount.sh, then you can define this in inputs.conf:

[script://$SPLUNK_HOME/etc/apps/your_app/bin/dircount.sh]
index = your_index
sourcetype = your_sourcetype
interval = number of seconds between runs

You can also configure this through the UI if run on a Searchhead, Indexer, or Heavy Forwarder by going to Settings -> Data Inputs -> Scripts -> New.

Find the docs here: http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Setupcustominputs

Re: how to count the number of files and directories in a folder in splunk

Afef — Thu, 14 Aug 2014 07:48:30 GMT

Thank you martin, but i'm working with windows not linux, so what should i do ?

Re: how to count the number of files and directories in a folder in splunk

martin_mueller — Thu, 14 Aug 2014 09:07:24 GMT

I'm sure similar things can be done with PowerShell. A quick googling suggests something like this: http://stackoverflow.com/questions/14714284/count-items-in-a-folder-with-powershell