Splunk Search

fschange on auto-rotated config files


So I have an application that auto-rotates its config files every time it is changed, and uses the following structure for filenames across changes.

config.2010-09-01T12:00:00 config.2010-09-02T13:53:00

I'd like to use fschange to diff these config files. The problem is that Splunk expects a path (or filename) that is to be monitored and to diff changes on one file.

Is there any way to have Splunk basically perform the tasks of the fsmonitor input type, except across these multiple files, treating them as one file?

Thanks, --adam

0 Karma

Splunk Employee
Splunk Employee

What do you mean by you want fschange to "diff" the files? Do you mean you want it recorded whenever the contents change, or do you mean you want the contents of every file version recorded? (Basically, do you want fullEvent=false, or fullEvent=true on fschange?)

If it's the latter, I don't think you need to do anything. When you want to diff the file content, you can simply use wildcards in the source name when you query for it, rather than a specific file name. If you want, you could create a TRANSFORM to modify the source name into a "base" source that doesn't contain a timestamp, so you'd search on source=config rather than source=config.*.

If it's the latter and you don't want unchanged versions recorded, I think you could use monitor instead of fschange, and in props.conf set CHECK_METHOD = entire_md5 for the file.

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...