Monitor files in a directory

[Wilson]

Is there anyway for Splunk to monitor files in a directory? I do not need the content of the files to be analysis (since it is not a log file) but more to list new files in a directory.

The specific scenario is that I am creating a operation monitoring dashboard. One of the panel will contain random documents which contains security alerts from various sources. The format of the file could be PDF, random text in a text file, email etc - which they do not have a structure format. It is not an XML feed from external. I want to make the operations team aware that an alert come it from authoritative source for further analysis.

What will be the best way to do that? Thank you in advance for your input.

[datasearchninja · Accepted solution]

I'd suggest the 'script' type input.

1) Write a short shell script that prints the data and time and then lists the contents of the directory. Put this script in the ./bin dir of the app.
2) In inputs.conf use the 'script' type input to run the script on a regular basis with the 'interval' param.
3) In splunk search you could then check for differences in the output.

[Wilson]

Thank you Colin. I will give this a go.