All Apps and Add-ons

fschange search issue

gajananh999
Contributor

Dear All,

I monitoring one folder in that folder xml file get created at certain time and it get deleted at certain time so i need to minitor if the file any xml file stay more than 5 min in folder then we need to fire a alert.

here is my search query

index=test sourcetype=fschangeevents | head 1 | eval newtime=now()-_time | table path,newtime | where newtime>300

this will give me recent one event and check if that event is duration is more than 5 min st that moment. but here there is one problem event might be deleted also added also

I Have modified my search because there might be more than one file in folder so cant use head 1 here so i need to monitor each and every file

here it is but still facing a problem not able to calculate the time difference

index=test sourcetype=fschangeevents | stats values(_time) as intime, count(_time) as totatation by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

my query is running good but its not printing newtime could anyone please help me here

Thanks

Gajanan Hiroji

0 Karma
1 Solution

gajananh999
Contributor

I have resolved this issue.by using below query

index=test sourcetype=fschangeevents | stats count(_time) as totatation, values(_time) as intime, by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

Thanks

Gajanan Hiroji

View solution in original post

0 Karma

gajananh999
Contributor

I have resolved this issue.by using below query

index=test sourcetype=fschangeevents | stats count(_time) as totatation, values(_time) as intime, by path | convert ctime(intime) | where totatation < 2 | eval newtime=now()-intime| table path,intime,totatation,newtime

Thanks

Gajanan Hiroji

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...