Splunk Search

fschange on auto-rotated config files


So I have an application that auto-rotates its config files every time it is changed, and uses the following structure for filenames across changes.

config.2010-09-01T12:00:00 config.2010-09-02T13:53:00

I'd like to use fschange to diff these config files. The problem is that Splunk expects a path (or filename) that is to be monitored and to diff changes on one file.

Is there any way to have Splunk basically perform the tasks of the fsmonitor input type, except across these multiple files, treating them as one file?

Thanks, --adam

0 Karma

Splunk Employee
Splunk Employee

What do you mean by you want fschange to "diff" the files? Do you mean you want it recorded whenever the contents change, or do you mean you want the contents of every file version recorded? (Basically, do you want fullEvent=false, or fullEvent=true on fschange?)

If it's the latter, I don't think you need to do anything. When you want to diff the file content, you can simply use wildcards in the source name when you query for it, rather than a specific file name. If you want, you could create a TRANSFORM to modify the source name into a "base" source that doesn't contain a timestamp, so you'd search on source=config rather than source=config.*.

If it's the latter and you don't want unchanged versions recorded, I think you could use monitor instead of fschange, and in props.conf set CHECK_METHOD = entire_md5 for the file.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...