Getting Data In

fschange not working


Dear All,

I am need to monitor a folder in which which all file are getting generated and which all the files get deleted at what all time all those things.
here is my syntax.

Am i making mistake here?


signedaudit = false

index = test

sourcetype = fschangeevents


Gajanan Hiroji

0 Karma

Splunk Employee
Splunk Employee

fschange has long been deprecated, so it is recommended that you take advantage of file system auditing on your chosen platform and let Splunk consume the audit information.

It appears that the file you wish to audit is on Windows... THIS article gives you the step by step info.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...