Splunk Search

fschange on auto-rotated config files


So I have an application that auto-rotates its config files every time it is changed, and uses the following structure for filenames across changes.

config.2010-09-01T12:00:00 config.2010-09-02T13:53:00

I'd like to use fschange to diff these config files. The problem is that Splunk expects a path (or filename) that is to be monitored and to diff changes on one file.

Is there any way to have Splunk basically perform the tasks of the fsmonitor input type, except across these multiple files, treating them as one file?

Thanks, --adam

0 Karma

Splunk Employee
Splunk Employee

What do you mean by you want fschange to "diff" the files? Do you mean you want it recorded whenever the contents change, or do you mean you want the contents of every file version recorded? (Basically, do you want fullEvent=false, or fullEvent=true on fschange?)

If it's the latter, I don't think you need to do anything. When you want to diff the file content, you can simply use wildcards in the source name when you query for it, rather than a specific file name. If you want, you could create a TRANSFORM to modify the source name into a "base" source that doesn't contain a timestamp, so you'd search on source=config rather than source=config.*.

If it's the latter and you don't want unchanged versions recorded, I think you could use monitor instead of fschange, and in props.conf set CHECK_METHOD = entire_md5 for the file.

Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...