All Apps and Add-ons

fschange search issue

gajananh999
Contributor

Dear All,

I monitoring one folder in that folder xml file get created at certain time and it get deleted at certain time so i need to minitor if the file any xml file stay more than 5 min in folder then we need to fire a alert.

here is my search query

index=test sourcetype=fschangeevents | head 1 | eval newtime=now()-_time | table path,newtime | where newtime>300

this will give me recent one event and check if that event is duration is more than 5 min st that moment. but here there is one problem event might be deleted also added also

I Have modified my search because there might be more than one file in folder so cant use head 1 here so i need to monitor each and every file

here it is but still facing a problem not able to calculate the time difference

index=test sourcetype=fschangeevents | stats values(_time) as intime, count(_time) as totatation by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

my query is running good but its not printing newtime could anyone please help me here

Thanks

Gajanan Hiroji

0 Karma
1 Solution

gajananh999
Contributor

I have resolved this issue.by using below query

index=test sourcetype=fschangeevents | stats count(_time) as totatation, values(_time) as intime, by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

Thanks

Gajanan Hiroji

View solution in original post

0 Karma

gajananh999
Contributor

I have resolved this issue.by using below query

index=test sourcetype=fschangeevents | stats count(_time) as totatation, values(_time) as intime, by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

Thanks

Gajanan Hiroji

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...