In windows, you need to turn object auditing for the folder you are monitoring. Windows will then log events in the windows security log. Assuming you are splunking this, you can start searching for events. ... View more

As far as I know, you can not tell splunk to start at the earliest time and work forward. The search sequence is hard coded but you can improve on the reverse command if you do not want later events. The tail command will always show you the last x events in a list so this will show the last 3 (which equates to earliest as time is descending in our results.) search | tail 3 This is marginally quicker as splunk just throws away earlier events rather than sort them. ... View more