topic How to trigger alert if new file is created in empty folder? in Alerting

How to trigger alert if new file is created in empty folder?

SplunkCSIT — Wed, 11 Jun 2014 13:24:03 GMT

Hi,

What will be the search if I wish to create an alert such that it triggers an alert when there is a file created in an empty folder? thks

Re: How to trigger alert if new file is created in empty folder?

MuS — Wed, 11 Jun 2014 14:22:20 GMT

Hi SplunkCSIT,

in inputs.conf you have to setup a monitor stanza for this directory / folder and assign a sourcetype. After that you can search for this sourcetype like this

 sourcetype=yourmonitoresourcetype

and when ever there is an event, fire an alert - done.

hope this helps ...

cheers, MuS

Re: How to trigger alert if new file is created in empty folder?

SplunkCSIT — Tue, 17 Jun 2014 12:54:03 GMT

Hi,if i wish to monitor the folder every 7mins, alert when there is a file created in d:\check, is the below monitor correct? If so, how come it dont work? thks

[monitor://D:\check]
disabled = false
followTail = 0
index = monitorfolder
sourcetype = monfolder

Re: How to trigger alert if new file is created in empty folder?

MuS — Tue, 17 Jun 2014 13:01:56 GMT

a monitor in inputs.conf will monitor continuously the defined folder, if you want to have a cron like check use scripted in inputs.
Why is it not working? check the permission on the folder, check splunkd.log for errors related to this path.
btw followTail = 0 is not needed in your case.