All Apps and Add-ons

fschange search issue

gajananh999
Contributor

Dear All,

I monitoring one folder in that folder xml file get created at certain time and it get deleted at certain time so i need to minitor if the file any xml file stay more than 5 min in folder then we need to fire a alert.

here is my search query

index=test sourcetype=fschangeevents | head 1 | eval newtime=now()-_time | table path,newtime | where newtime>300

this will give me recent one event and check if that event is duration is more than 5 min st that moment. but here there is one problem event might be deleted also added also

I Have modified my search because there might be more than one file in folder so cant use head 1 here so i need to monitor each and every file

here it is but still facing a problem not able to calculate the time difference

index=test sourcetype=fschangeevents | stats values(_time) as intime, count(_time) as totatation by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

my query is running good but its not printing newtime could anyone please help me here

Thanks

Gajanan Hiroji

0 Karma
1 Solution

gajananh999
Contributor

I have resolved this issue.by using below query

index=test sourcetype=fschangeevents | stats count(_time) as totatation, values(_time) as intime, by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

Thanks

Gajanan Hiroji

View solution in original post

0 Karma

gajananh999
Contributor

I have resolved this issue.by using below query

index=test sourcetype=fschangeevents | stats count(_time) as totatation, values(_time) as intime, by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

Thanks

Gajanan Hiroji

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...