Scan directory for occurance of file and alert

[phil998]

I am trying to find a solution for the following problem using splunk.

What needs to happen:

1. A cron job runs every few minutes to fire of a search/scan for a core dump(The file will only be present if a fatal error has occured).
2. If the file is found an alert will be issed to needed people and applications(Using an alert)

Is there a way to do this? I've tried using source="C:\foo\bar\log\log\*" earliest=-2M@M as noted here in this question link, but with no luck. Is this easily possible?

[dwaddle · Accepted solution]

Use Splunk's fschange capability. It will scan for the creation of a new file, and log an event when it happens. Then, your cron job is no longer needed. We do this today for javacores in J2EE apps.

[phil998]

I was trying to call a python or perl script from the alert to create tickets/alerts in a few other systems. I will look into fschange as noted below. Thank you.

[Brian_Osburn]

Does that cron job write to a log that Splunk can read?