Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Monitor files in a directory
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there anyway for Splunk to monitor files in a directory? I do not need the content of the files to be analysis (since it is not a log file) but more to list new files in a directory.
The specific scenario is that I am creating a operation monitoring dashboard. One of the panel will contain random documents which contains security alerts from various sources. The format of the file could be PDF, random text in a text file, email etc - which they do not have a structure format. It is not an XML feed from external. I want to make the operations team aware that an alert come it from authoritative source for further analysis.
What will be the best way to do that? Thank you in advance for your input.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd suggest the 'script' type input.
1) Write a short shell script that prints the data and time and then lists the contents of the directory. Put this script in the ./bin dir of the app.
2) In inputs.conf use the 'script' type input to run the script on a regular basis with the 'interval' param.
3) In splunk search you could then check for differences in the output.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd suggest the 'script' type input.
1) Write a short shell script that prints the data and time and then lists the contents of the directory. Put this script in the ./bin dir of the app.
2) In inputs.conf use the 'script' type input to run the script on a regular basis with the 'interval' param.
3) In splunk search you could then check for differences in the output.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Colin. I will give this a go.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
