Hi,
What will be the search if I wish to create an alert such that it triggers an alert when there is a file created in an empty folder? thks
Hi SplunkCSIT,
in inputs.conf you have to setup a monitor stanza for this directory / folder and assign a sourcetype. After that you can search for this sourcetype like this
sourcetype=yourmonitoresourcetype
and when ever there is an event, fire an alert - done.
hope this helps ...
cheers, MuS
a monitor
in inputs.conf will monitor continuously the defined folder, if you want to have a cron like check use scripted in inputs.
Why is it not working? check the permission on the folder, check splunkd.log for errors related to this path.
btw followTail = 0
is not needed in your case.
Hi,if i wish to monitor the folder every 7mins, alert when there is a file created in d:\check, is the below monitor correct? If so, how come it dont work? thks
[monitor://D:\check]
disabled = false
followTail = 0
index = monitorfolder
sourcetype = monfolder