How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

[Falcon1]

Using Windows version of Splunk to check a directory and if it exceeds 200 files, send an alert.

Thank you for your help

[adonio]

hello there,

check out this link.
you can create a scripted input based on methods 3 or 4 described in the article

https://www.digitalcitizen.life/4-ways-count-number-folders-and-files-inside-folder
please share with us your results, other users might find it useful too 🙂

hope it helps

[Falcon1]

Thanks adonio,

Got the scripting part, just not sure how to enter in Splunk and once entered in Splunk running a Search and Alerting.

Thank you.

[adonio]

nice!
can you share?
here is a good explanation about setting up a scripted input
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/AdvancedDev/ScriptSetup
for a live example, download the TA for nix (or another TA with scripted inputs)
untar it and navigate to the /default/inputs.conf file
open the file and see the references , example:
[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
index = os
disabled = 1

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

navigate to /bin (in the app directory) to see the relevant scripts that are tied with the input

hope it helps

[somesoni2]

AFAIK, there is no direct monitoring feature available to monitor a directory for number of files. What you can do is that to write a powershell script OR batch file to count the number of files (of list of files) at regular interval, and send that data to Splunk. You'd also need to setup custom sourcetype to parse this data (e.g. if you're listing all the files in that folder, use settings to get one files name per line/event). Once the data is in Splunk, you can write a search to alert (e.g. index=foo sourcetype=bar | stats count | where count>200).

[Falcon1]

Hi somesoni2,

Thank you for the reply.

Can I have examples for the powershell script and in the script how do I send data to Splunk?

Thank you.