topic Re: How to use Splunk to monitor if a new file was added to a folder? in Getting Data In

How to use Splunk to monitor if a new file was added to a folder?

felixms — Tue, 29 Dec 2015 22:44:44 GMT

As of today, is there a way to simply monitor a folder for new files created on it?

Right now, I am monitoring a folder via Data Input > Folder, and Splunk is listing the 5 lines of the single .txt file on that folder.
When, I just need to trigger an alert when a new file is added to that folder.

Re: How to use Splunk to monitor if a new file was added to a folder?

renjith_nair — Wed, 30 Dec 2015 03:31:30 GMT

Splunk monitors files added to the directory automatically if you have configured monitor for a directory

Ref : http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Monitorfilesanddirectories

Whenever a new file is added, splunk creates a new source for that file unless you override the source parameter in the inputs.conf.

In that case, you can create an alert when a new source is created by comparing the count with previous one or looking for a specific event from the new file etc.

Re: How to use Splunk to monitor if a new file was added to a folder?

felixms — Wed, 30 Dec 2015 17:51:18 GMT

Thank you, Renjith.
I am a new user, so when you mentioned "you can create an alert when a new source is created by comparing the count with previous one or looking for a specific event from the new file etc."

Are these the steps to perform the above?
1. Go to Search and type the count comparison
2. Save this as an alert

Could you give a link or a sample syntax to do the comparison?

Re: How to use Splunk to monitor if a new file was added to a folder?

renjith_nair — Thu, 31 Dec 2015 04:23:58 GMT

Try this

|metadata type=sources|eval difference=now() - firstTime|fields source difference|where difference < 300

This will list the sources which have appeared in last 5 minutes. Schedule this for reasonable time window according to your requirement and adjust the difference accordingly. Try the above search without the where clause and test it

Re: How to use Splunk to monitor if a new file was added to a folder?

felixms — Mon, 04 Jan 2016 23:43:55 GMT

Thank you!