fschange not working

gajananh999 · ‎09-01-2014

Dear All,

I am need to monitor a folder in which which all file are getting generated and which all the files get deleted at what all time all those things.
here is my syntax.

Am i making mistake here?

[fschange:D:\Test_logs\testingfschange\]

signedaudit = false

index = test

sourcetype = fschangeevents

Thanks

Gajanan Hiroji

rsennett_splunk · ‎09-01-2014

fschange has long been deprecated, so it is recommended that you take advantage of file system auditing on your chosen platform and let Splunk consume the audit information.

It appears that the file you wish to audit is on Windows... THIS article gives you the step by step info.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

fschange not working

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Keep the Learning Going with the New Best of .conf Hub

Join the Conversation

fschange not working

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Keep the Learning Going with the New Best of .conf Hub