Getting Data In

Difference between monitor and fschange

Splunk Employee
Splunk Employee

[1] May I know what are the differences between using monitor or fschange?

[2] Is there a documentation about fschange? If there isn't, how do I make use of it?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

[link text][1]Monitor is intended to be the input method for live log files that you continuously write data to. The fschange input method is intended to monitor a change in the filesystem. A basic example for each item:

  • use monitor for a web log file or java app log file
  • use fschange for a system file or configuration file

For more details you can read the documentation here:

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

http://www.splunk.com/base/Documentation/latest/Admin/Monitorchangestoyourfilesystem

View solution in original post

Splunk Employee
Splunk Employee

[link text][1]Monitor is intended to be the input method for live log files that you continuously write data to. The fschange input method is intended to monitor a change in the filesystem. A basic example for each item:

  • use monitor for a web log file or java app log file
  • use fschange for a system file or configuration file

For more details you can read the documentation here:

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

http://www.splunk.com/base/Documentation/latest/Admin/Monitorchangestoyourfilesystem

View solution in original post

Motivator
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!