Directory monitoring

DonDandrea · ‎05-23-2014

Is it possible to monitor a directory with Splunk? When I say monitor a directory I am not interested in the contents of the files in the directory. I am an interested in logging the filenames and timestamps of the files in the directory.

lguinn2 · ‎05-23-2014

Yes, the feature is called "fschange monitor" and you use it like this in inputs.conf

[fschange:<path>]

However, the feature is deprecated (although it hasn't been removed yet), so you might want to look at this
fschange deprecated, what are the options

Also, Splunk cannot do fschange and a regular monitor over the same files/directories.

Directory monitoring

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Directory monitoring

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue