1. It's a veeeeeery old thread (over 10 years since last post) 2. Monitoring changes to filesystem is a completely different issue than logging changes on a file sharing platform (regardless of whether we're talking NFS, CIFS, DAV...). First thing would be to make sure that the service itself can and will log relevant data. ... View more

The documentation; will answer your question: http://docs.splunk.com/Documentation/Splunk/5.0.6/Installation/HowtoupgradeSplunk when upgrading to 5.0.x, going from 4.2.x is a supported path. Going to 6.x you have to be on 4.3+. There is also a list of things to consider and warnings on back ups before you update. The subtopics will answer questions around upgrade order for distributed environments and/or the order of forwarder upgrades in relation to your servers. ... View more

STEALTHbits offers a file activity monitor and preconfigured Splunk dashboard https://splunkbase.splunk.com/app/3432/ ... View more

Thanks for the helpful tip jbslunk, i will definitely look into this. Thank you ... View more

NEW FEATURE ALERT! As of Splunk 6.6, you can now do this from the Search Head GUI with the new Reassign Knowledge Objects feature: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/ReleaseNotes/NewSplunkCloudFeatures https://www.splunk.com/blog/2017/05/02/what-s-new-in-splunk-enterprise-6-6-and-splunk-cloud.html You can also do this from the REST API: https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API ... View more