Getting Data In

What is the procedure to monitor changes to file content?

nagarajugowdkal
New Member

Hi,

What is the procedure to monitor changes to file content? As per knowledge we can add some parameters to props.conf file.

Can anyone please provide step by step procedure to achieve this?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

There is detailed documentation about how to Monitor files and directories in the Getting Data In manual. Here is the link to the procedure to do it from Splunk Web. If you can pose a more specific question, the community can probably help you better.

0 Karma

somesoni2
Revered Legend

Without much details, I would suggest to see these links.

File monitoring in Splunk
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Monitorfilesanddirectories

File system change monitoring in Splunk
https://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Monitorchangestoyourfilesystem

0 Karma

nagarajugowdkal
New Member

HI,

i have added below in inputs.conf file

it is not showing the changes after updating sample.conf file and using below search command

index=file_monitor sourcetype=fschange | diff diffheader=true | highlight +,-

inputs.conf

[fschange://home/splunk/config]
disabled = 0
host = 12b8-spnfwd03
index = file_monitor
recurse = true
pollPeriod = 1
fullEvent = true
sendEventMaxSize = -1
hashMaxSize = 99999999
sourcetype = fschange

[monitor:///home/splunk/config/sample.conf]
followTail = 0
host = 12b8-spnfwd03
disabled = false
index = file_monitor
sourcetype = fschange
0 Karma

ddrillic
Ultra Champion

What do you mean by saying? -

-- What is the procedure to monitor changes to file content?

Are you speaking about log files? anything else...

0 Karma

nagarajugowdkal
New Member

Hi,
i am talking about configuration file say like sample.conf and having content like below

how can i monitor and display if something is modified on below content

VirtualToken = {
   VirtualToken00Label = HA_hktl;
   VirtualToken00SN = 1157803010;
   VirtualToken00Members = 157803010,155322014;
}
HASynchronize = {
   HA_HOL = 1;
}
HAConfiguration = {
   HAOnly = 1;
   haLogPath = /apps/hktl;
   logLen = 262144;
   haLogStatus = enabled;
   reconnAtt = 5;
}
hktl = {
  DefaultTimeOut = 200000;
  PEDTimeout1 = 100000;
  PEDTimeout2 = 100000;
  PEDTimeout3 = 10000;
  KeypairGenTimeOut = 3700000;
  CloningCommandTimeOut = 300000;
}
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...