https://community.splunk.com/t5/Getting-Data-In/File-system-changes-not-log-monitoring/m-p/188357#M37563 <P>You should not be putting data in <CODE>_audit</CODE>, that is an internal index for Splunk to index its own events. I know that there is some stuff in the documentation that talks about this index, but unless you have already done all the other auditing setup, it isn't going to work.</P> <P>Create a new index - you could call it <CODE>audit</CODE> and send data to that index instead.</P> <PRE><CODE>[fschange:/path/to/dir/] index=audit </CODE></PRE> <P>Also, this feature is deprecated: <A href="http://docs.splunk.com/Documentation/Splunk/6.1/Data/Monitorchangestoyourfilesystem">Monitor changes to your filesystem</A></P> <P>You can still use it, but it might go away.</P> Wed, 04 Jun 2014 15:31:51 GMT lguinn2 2014-06-04T15:31:51Z https://community.splunk.com/t5/Getting-Data-In/File-system-changes-not-log-monitoring/m-p/188356#M37562 <P>Have an environment where a directory is used to 'stage' files waiting for an update. Essentially, a file is sent to a vendor and a local status file (of zero or more bytes) is placed in a 'pending' directory. Once the vendor has completed their work and a good return is received the local status file is moved to the 'done' directory. (This is done so a second process can use the listing to determine what status file to check for on it's run).</P> <P>What I want to do is monitor the '/pending' directory for new files only being worried about WHEN they showed up. Then, if they haven't 'moved' in a predetermined amount of time (depending upon environment this could be two - eight hours) raise an alert. This would also allow me to say "_time seen" and "_time gone" to build some metrics on vendor performance.</P> <P>All that being said, I am having issues getting it set up to forward from my linux universal forwarder. My inputs.conf stanza looks like:</P> <P>[fschange:/path/to/dir/]<BR /><BR /> signedaudit = false<BR /><BR /> index=_audit </P> <P>I read that in one of the previous 'answers' questions. Unfortunately, I am seeing no records in _audit or _internal for that host using the search head.</P> <P>Ideas?</P> Mon, 28 Sep 2020 16:47:19 GMT https://community.splunk.com/t5/Getting-Data-In/File-system-changes-not-log-monitoring/m-p/188356#M37562 tyronetv 2020-09-28T16:47:19Z https://community.splunk.com/t5/Getting-Data-In/File-system-changes-not-log-monitoring/m-p/188357#M37563 <P>You should not be putting data in <CODE>_audit</CODE>, that is an internal index for Splunk to index its own events. I know that there is some stuff in the documentation that talks about this index, but unless you have already done all the other auditing setup, it isn't going to work.</P> <P>Create a new index - you could call it <CODE>audit</CODE> and send data to that index instead.</P> <PRE><CODE>[fschange:/path/to/dir/] index=audit </CODE></PRE> <P>Also, this feature is deprecated: <A href="http://docs.splunk.com/Documentation/Splunk/6.1/Data/Monitorchangestoyourfilesystem">Monitor changes to your filesystem</A></P> <P>You can still use it, but it might go away.</P> Wed, 04 Jun 2014 15:31:51 GMT https://community.splunk.com/t5/Getting-Data-In/File-system-changes-not-log-monitoring/m-p/188357#M37563 lguinn2 2014-06-04T15:31:51Z