fschange not working

gajananh999 · ‎09-01-2014

Dear All,

I am need to monitor a folder in which which all file are getting generated and which all the files get deleted at what all time all those things.
here is my syntax.

Am i making mistake here?

[fschange:D:\Test_logs\testingfschange\]

signedaudit = false

index = test

sourcetype = fschangeevents

Thanks

Gajanan Hiroji

rsennett_splunk · ‎09-01-2014

fschange has long been deprecated, so it is recommended that you take advantage of file system auditing on your chosen platform and let Splunk consume the audit information.

It appears that the file you wish to audit is on Windows... THIS article gives you the step by step info.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

fschange not working

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

fschange not working

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A