What will be the search if I wish to create an alert such that it triggers an alert when there is a file created in an empty folder? thks
in inputs.conf you have to setup a monitor stanza for this directory / folder and assign a sourcetype. After that you can search for this sourcetype like this
and when ever there is an event, fire an alert - done.
hope this helps ...
Hi,if i wish to monitor the folder every 7mins, alert when there is a file created in d:\check, is the below monitor correct? If so, how come it dont work? thks
[monitor://D:\check] disabled = false followTail = 0 index = monitorfolder sourcetype = monfolder
monitor in inputs.conf will monitor continuously the defined folder, if you want to have a cron like check use scripted in inputs.
Why is it not working? check the permission on the folder, check splunkd.log for errors related to this path.
followTail = 0 is not needed in your case.