All Apps and Add-ons

Monitoring a Remote Directory for Changes WITHOUT Ingesting files into Splunk?

rosenma
New Member

HI All,

Long story short - I'm looking to monitor a remote directory for changes/new files/changes to files and send this information to Splunk. To re-emphasize, due to the nature of these files, I do NOT want to ingest the files themselves into Splunk. Metadata like, size, paths, owners, changes, etc. is what I am looking for.

I have discovered and set up Luke Murphey's "File/Directory Input" App - https://splunkbase.splunk.com/app/2776

However - After configuration, I'm not seeing anything come into Splunk...

M example path within this app on my Splunk Server (say 10.10.10.10) is set to something like this for my remote server directory:

10.10.10.20:/directory/to/watch/

Is this app capable of doing that remotely?

Should this path be something like user@ip:/path/to/folder ? Wouldn't I need ssh keys of sorts to do this?

 

If this app isn't the solution...

Is a Universal Forwarder able to be configured to do this monitoring and forward metadata without forwarding the files themselves?

 

Thanks in advance for any help.

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...