A monitored file changes very frequently. If no new change occurs during a specified interval, it means that the process which makes changes to the log file is down. This can be used to monitor if the process is alive. How can I monitor and generate alert on an event "no changes made to monitored file during nnn minutes"?
The monitored files are on a UNIX machine. The directories are accessible from a Windows machine with Splunk Forwarder (UNC is used in Spunk directory definition). Splunk Forwarder monitores these files, it is working now and communicating with Splunk Free (at this moment). So monitoring files works, I can check for errors, generate alerts on errors, etc. And I want to check an event "nothing happens to the files".