Splunk Search

fschange on auto-rotated config files


So I have an application that auto-rotates its config files every time it is changed, and uses the following structure for filenames across changes.

config.2010-09-01T12:00:00 config.2010-09-02T13:53:00

I'd like to use fschange to diff these config files. The problem is that Splunk expects a path (or filename) that is to be monitored and to diff changes on one file.

Is there any way to have Splunk basically perform the tasks of the fsmonitor input type, except across these multiple files, treating them as one file?

Thanks, --adam

0 Karma

Splunk Employee
Splunk Employee

What do you mean by you want fschange to "diff" the files? Do you mean you want it recorded whenever the contents change, or do you mean you want the contents of every file version recorded? (Basically, do you want fullEvent=false, or fullEvent=true on fschange?)

If it's the latter, I don't think you need to do anything. When you want to diff the file content, you can simply use wildcards in the source name when you query for it, rather than a specific file name. If you want, you could create a TRANSFORM to modify the source name into a "base" source that doesn't contain a timestamp, so you'd search on source=config rather than source=config.*.

If it's the latter and you don't want unchanged versions recorded, I think you could use monitor instead of fschange, and in props.conf set CHECK_METHOD = entire_md5 for the file.

Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...