send alert whenever there is certain file(s) created in a server(s)

[snabi]

My goal is to send alert whenever there is certain file(s) created in a server(s)

• I should be able to use target file names(s)
• I should be able to point to a directory where such file will be created
• I should be able to add file creation time and file size in those alerts

Thanks for your help

[dwaddle · Accepted solution]

Sounds like you want to use the fschange functionality. http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorchangestoyourfilesystem

And yes, this has been "deprecated in release 5.0". Some time in the future (when something better is available, or there is a recommendation as to the new best practice for replacing it), it will be removed from Splunk. But, that does not mean it's going away tomorrow, or even next week.