Getting Data In

Difference between monitor and fschange

Nicholas_Key
Splunk Employee
Splunk Employee

[1] May I know what are the differences between using monitor or fschange?

[2] Is there a documentation about fschange? If there isn't, how do I make use of it?

Tags (2)
1 Solution

Simeon
Splunk Employee
Splunk Employee

[link text][1]Monitor is intended to be the input method for live log files that you continuously write data to. The fschange input method is intended to monitor a change in the filesystem. A basic example for each item:

  • use monitor for a web log file or java app log file
  • use fschange for a system file or configuration file

For more details you can read the documentation here:

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

http://www.splunk.com/base/Documentation/latest/Admin/Monitorchangestoyourfilesystem

View solution in original post

Simeon
Splunk Employee
Splunk Employee

[link text][1]Monitor is intended to be the input method for live log files that you continuously write data to. The fschange input method is intended to monitor a change in the filesystem. A basic example for each item:

  • use monitor for a web log file or java app log file
  • use fschange for a system file or configuration file

For more details you can read the documentation here:

http://www.splunk.com/base/Documentation/latest/Admin/Monitorfilesanddirectories

http://www.splunk.com/base/Documentation/latest/Admin/Monitorchangestoyourfilesystem

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...