Getting Data In

how to monitor file change in a delta mode?

gavintofly
New Member

I am going to monitor file change on several servers,but I don't like the way of sharing directory .so I installed a sync software on these servers. When there is a file change,The change file was sync to a server for central management.And i use splunk to monitor the single server.After some time, i found that the index volume was overhead:the files was about 50M in total,but the index volume is 5G in a day. the files name did not change during the sync process.but everytime the sync process delete the oldfile and create a new file with the same name? Is this the reason of index overhead?

Tags (1)
0 Karma

treinke
Builder

Are you using Montior or FSChange? If you are using Monitor than Splunk is grabbing the content of the file and indexing it. If the file changes, it grabs the new data. If you are using FSChange, then every time the file changes a new md5 is created and Splunk will log that.

There are no answer without questions
0 Karma

treinke
Builder

Can you post you monitor stanza?

There are no answer without questions
0 Karma

gavintofly
New Member

I am using Monitor but everytime the content of files change,splunk grabs the whole file again.so the index volume run out quickly.how splunk identifies a file as a new file? the files monitored hold their name unchanged but everytime the files change,the file was deleted and created again.Is this the cause of problem?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...