How do you get Splunk to monitor and alert if a file stays in the folder for longer time?

[Navanitha]

We have a server performing IN and OUT operation on a file, when a file gets generated in the folder, it doesn't stay for a long time (not even few seconds) which is a normal behaviour. Now, we want Splunk to monitor if a file stays there for longer time, say like 10min and alert us.

I tried reading Splunk Answers, but I couldn't get to any solutions.

Can someone throw some light on how to achieve this?

Thank you,

[inventsekar]

Please check the fschange

File system change monitor (fschange monitor)

The file system change monitor has been deprecated as of Splunk Enterprise

version 5.0 and might be removed in a future version of the product.

https://answers.splunk.com/answers/63715/file-age-processing-measurement.html

https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Inputsconf

on linux, this audit package will be very helpful:
https://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

[Navanitha]

Hi inventsekar,

I did read about this but not sure if it suits my requirement here or not. fschange will monitor for any modifications but my file doen't have any modifications once it gets created. Not sure why I can use this in my case.

[inventsekar]

[fschange:/xxx/yyy/pending]
 pollPeriod=60
 sourcetype=PendingFileMonitor

This will create an event every time a file is added, deleted or changed in the directory.