topic Re: How to use Splunk to check a directory to see if it exceeds 200 files to send an alert? in Getting Data In

How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

Falcon1 — Mon, 29 Jan 2018 16:29:00 GMT

Using Windows version of Splunk to check a directory and if it exceeds 200 files, send an alert.

Thank you for your help

Re: How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

somesoni2 — Mon, 29 Jan 2018 16:51:24 GMT

AFAIK, there is no direct monitoring feature available to monitor a directory for number of files. What you can do is that to write a powershell script OR batch file to count the number of files (of list of files) at regular interval, and send that data to Splunk. You'd also need to setup custom sourcetype to parse this data (e.g. if you're listing all the files in that folder, use settings to get one files name per line/event). Once the data is in Splunk, you can write a search to alert (e.g. index=foo sourcetype=bar | stats count | where count>200).

Re: How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

Falcon1 — Tue, 30 Jan 2018 11:38:04 GMT

Hi somesoni2,

Thank you for the reply.

Can I have examples for the powershell script and in the script how do I send data to Splunk?

Thank you.

Re: How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

adonio — Tue, 30 Jan 2018 14:08:54 GMT

hello there,

check out this link.
you can create a scripted input based on methods 3 or 4 described in the article

https://www.digitalcitizen.life/4-ways-count-number-folders-and-files-inside-folder
please share with us your results, other users might find it useful too 🙂

hope it helps

Re: How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

Falcon1 — Tue, 30 Jan 2018 17:21:49 GMT

Thanks adonio,

Got the scripting part, just not sure how to enter in Splunk and once entered in Splunk running a Search and Alerting.

Thank you.

Re: How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

adonio — Tue, 30 Jan 2018 18:22:21 GMT

nice!
can you share?
here is a good explanation about setting up a scripted input
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/AdvancedDev/ScriptSetup
for a live example, download the TA for nix (or another TA with scripted inputs)
untar it and navigate to the /default/inputs.conf file
open the file and see the references , example:
[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
index = os
disabled = 1

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

navigate to /bin (in the app directory) to see the relevant scripts that are tied with the input

hope it helps