Getting Data In

How to use Splunk to check a directory to see if it exceeds 200 files to send an alert?

New Member

Using Windows version of Splunk to check a directory and if it exceeds 200 files, send an alert.

Thank you for your help

0 Karma

SplunkTrust
SplunkTrust

hello there,

check out this link.
you can create a scripted input based on methods 3 or 4 described in the article

https://www.digitalcitizen.life/4-ways-count-number-folders-and-files-inside-folder
please share with us your results, other users might find it useful too 🙂

hope it helps

New Member

Thanks adonio,

Got the scripting part, just not sure how to enter in Splunk and once entered in Splunk running a Search and Alerting.

Thank you.

0 Karma

SplunkTrust
SplunkTrust

nice!
can you share?
here is a good explanation about setting up a scripted input
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/AdvancedDev/ScriptSetup
for a live example, download the TA for nix (or another TA with scripted inputs)
untar it and navigate to the /default/inputs.conf file
open the file and see the references , example:
[script://./bin/vmstat.sh]
interval = 60
sourcetype = vmstat
source = vmstat
index = os
disabled = 1

[script://./bin/iostat.sh]
interval = 60
sourcetype = iostat
source = iostat
index = os
disabled = 1

navigate to /bin (in the app directory) to see the relevant scripts that are tied with the input

hope it helps

0 Karma

Revered Legend

AFAIK, there is no direct monitoring feature available to monitor a directory for number of files. What you can do is that to write a powershell script OR batch file to count the number of files (of list of files) at regular interval, and send that data to Splunk. You'd also need to setup custom sourcetype to parse this data (e.g. if you're listing all the files in that folder, use settings to get one files name per line/event). Once the data is in Splunk, you can write a search to alert (e.g. index=foo sourcetype=bar | stats count | where count>200).

0 Karma

New Member

Hi somesoni2,

Thank you for the reply.

Can I have examples for the powershell script and in the script how do I send data to Splunk?

Thank you.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!