Getting Data In

Monitor files in a directory

Wilson
Engager

Is there anyway for Splunk to monitor files in a directory? I do not need the content of the files to be analysis (since it is not a log file) but more to list new files in a directory.

The specific scenario is that I am creating a operation monitoring dashboard. One of the panel will contain random documents which contains security alerts from various sources. The format of the file could be PDF, random text in a text file, email etc - which they do not have a structure format. It is not an XML feed from external. I want to make the operations team aware that an alert come it from authoritative source for further analysis.

What will be the best way to do that? Thank you in advance for your input.

Tags (1)
0 Karma
1 Solution

datasearchninja
Communicator

I'd suggest the 'script' type input.

1) Write a short shell script that prints the data and time and then lists the contents of the directory. Put this script in the ./bin dir of the app.
2) In inputs.conf use the 'script' type input to run the script on a regular basis with the 'interval' param.
3) In splunk search you could then check for differences in the output.

View solution in original post

datasearchninja
Communicator

I'd suggest the 'script' type input.

1) Write a short shell script that prints the data and time and then lists the contents of the directory. Put this script in the ./bin dir of the app.
2) In inputs.conf use the 'script' type input to run the script on a regular basis with the 'interval' param.
3) In splunk search you could then check for differences in the output.

Wilson
Engager

Thank you Colin. I will give this a go.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...