topic Re: monitor file in Alerting

monitor file

newbiesplunk — Tue, 03 Jun 2014 13:58:40 GMT

I was just wondering if Splunk can be scheduled to monitor a unique file e.g c:\test.txt regularly, and send out alerts if this file does not get updated for a specific time period , lets say for 5 minutes.
Please help, thks

Re: monitor file

somesoni2 — Tue, 03 Jun 2014 14:08:23 GMT

A regular file monitoring can be setup for this file which will get indexed into a specific index/sourcetype. Once this is setup, you can create a schedule search which will run every 5min and check if there are any data from the file in the specific index/sourcetype, if not than trigger alert.

Re: monitor file

lguinn2 — Tue, 03 Jun 2014 17:57:29 GMT

Yes, it is quite simple. There are several ways to do it, but I recommend this:

| metadata type=sources | where source="C:\test.txt" 
| eval "Last Update"=strftime(lasttime, "%c")
| table source "Last Update"

will list the file and the last time Splunk received data from that file. If this works for you, then use the following variation and alert if number of results > 0.

| metadata type=sources | where source="C:\test.txt" 
| where lasttime < now()-300
| eval "Last Update"=strftime(lasttime, "%c")
| table source "Last Update"

now()-300 is the epoch time of "5 minutes ago"

Re: monitor file

newbiesplunk — Thu, 05 Jun 2014 13:09:13 GMT

Hi,
when i entered | metadata type=sources | where source="C:\test.txt"
| eval "Last Update"=strftime(lasttime, "%c")
| table source "Last Update"to search, nothing returns even though i got one file. Anything else i need to set? thks