You can use fschange stanza
Refer to below link
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitorchangestoyourfilesystem
Can anyone do video tutorial?
You can use fschange stanza
Refer to below link
http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Monitorchangestoyourfilesystem