fschange not working

gajananh999 · ‎09-01-2014

Dear All,

I am need to monitor a folder in which which all file are getting generated and which all the files get deleted at what all time all those things.
here is my syntax.

Am i making mistake here?

[fschange:D:\Test_logs\testingfschange\]

signedaudit = false

index = test

sourcetype = fschangeevents

Thanks

Gajanan Hiroji

rsennett_splunk · ‎09-01-2014

fschange has long been deprecated, so it is recommended that you take advantage of file system auditing on your chosen platform and let Splunk consume the audit information.

It appears that the file you wish to audit is on Windows... THIS article gives you the step by step info.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

fschange not working

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Join the Conversation

fschange not working

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose