https://community.splunk.com/t5/Getting-Data-In/fschange-not-working/m-p/199014#M39428 <P>Dear All,</P> <P>I am need to monitor a folder in which which all file are getting generated and which all the files get deleted at what all time all those things.<BR /> here is my syntax.</P> <P>Am i making mistake here?</P> <P>[fschange:D:\Test_logs\testingfschange\]</P> <P>signedaudit = false</P> <P>index = test</P> <P>sourcetype = fschangeevents</P> <P>Thanks</P> <P>Gajanan Hiroji</P> Mon, 01 Sep 2014 15:32:14 GMT gajananh999 2014-09-01T15:32:14Z https://community.splunk.com/t5/Getting-Data-In/fschange-not-working/m-p/199014#M39428 <P>Dear All,</P> <P>I am need to monitor a folder in which which all file are getting generated and which all the files get deleted at what all time all those things.<BR /> here is my syntax.</P> <P>Am i making mistake here?</P> <P>[fschange:D:\Test_logs\testingfschange\]</P> <P>signedaudit = false</P> <P>index = test</P> <P>sourcetype = fschangeevents</P> <P>Thanks</P> <P>Gajanan Hiroji</P> Mon, 01 Sep 2014 15:32:14 GMT https://community.splunk.com/t5/Getting-Data-In/fschange-not-working/m-p/199014#M39428 gajananh999 2014-09-01T15:32:14Z https://community.splunk.com/t5/Getting-Data-In/fschange-not-working/m-p/199015#M39429 <P><CODE>fschange</CODE> has long been deprecated, so it is recommended that you take advantage of file system auditing on your chosen platform and let Splunk consume the audit information.</P> <P>It appears that the file you wish to audit is on Windows... <A href="http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/" target="blog">THIS</A> article gives you the step by step info.</P> Mon, 01 Sep 2014 16:17:40 GMT https://community.splunk.com/t5/Getting-Data-In/fschange-not-working/m-p/199015#M39429 rsennett_splunk 2014-09-01T16:17:40Z