Unathorized access files

[ajeeshneelamkav]

Hello All,

I am new to splunk and have following use case requirement

Only service account(svc) is permitted to access the files in a directory on a Linux machine. Successful and failed access attempts by any other users to this files needs to be reported.

We are using splunk 6.1 an how can I achieve this.

[kml_uvce]

you can indexed the log file which has the user access information about the directory.
write this in inputs.conf
[monitor:///<log file>]

[ajeeshneelamkav]

That has been enabled but what to write in search query to capture this unauthorized access to file? Is there any specific field value which can be measured or capture nametype= NORMAL and other than this user will it work?