Getting Data In

fschange pollPeriod parameter

kkuminsky
Path Finder

If I specify pollPeriod parameter for fschange, is it supposed to generate an event each time it checks file for changes or only if it checks and finds that the file was changed?

I monitor for changes separate files as well as folders. Is pollPeriod supposed to work for separate file monitoring also or for folder monitoring only?

0 Karma
1 Solution

the_wolverine
Champion

The pollPeriod setting only determines how often Splunk will check to see whether the monitored configuration file has changed.

The expected behavior is that an event will be created ONLY when there is a change detected.

View solution in original post

the_wolverine
Champion

The pollPeriod setting only determines how often Splunk will check to see whether the monitored configuration file has changed.

The expected behavior is that an event will be created ONLY when there is a change detected.

kkuminsky
Path Finder

Thank you for the answer. I would expect such behavior too, but that's not what I'm getting.

Please, see the following post with some details: http://answers.splunk.com/questions/3609/fschange-file-monitoring/3626#3626 ("fschange file monitoring")

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...