What is the procedure to monitor changes to file content?

[nagarajugowdkal]

Hi,

What is the procedure to monitor changes to file content? As per knowledge we can add some parameters to props.conf file.

Can anyone please provide step by step procedure to achieve this?

[ChrisG]

There is detailed documentation about how to Monitor files and directories in the Getting Data In manual. Here is the link to the procedure to do it from Splunk Web. If you can pose a more specific question, the community can probably help you better.

[somesoni2]

Without much details, I would suggest to see these links.

File monitoring in Splunk
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Monitorfilesanddirectories

File system change monitoring in Splunk
https://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Monitorchangestoyourfilesystem

[nagarajugowdkal]

HI,

i have added below in inputs.conf file

it is not showing the changes after updating sample.conf file and using below search command

index=file_monitor sourcetype=fschange | diff diffheader=true | highlight +,-

inputs.conf

[fschange://home/splunk/config]
disabled = 0
host = 12b8-spnfwd03
index = file_monitor
recurse = true
pollPeriod = 1
fullEvent = true
sendEventMaxSize = -1
hashMaxSize = 99999999
sourcetype = fschange

[monitor:///home/splunk/config/sample.conf]
followTail = 0
host = 12b8-spnfwd03
disabled = false
index = file_monitor
sourcetype = fschange

[ddrillic]

What do you mean by saying? -

-- What is the procedure to monitor changes to file content?

Are you speaking about log files? anything else...

[nagarajugowdkal]

Hi,
i am talking about configuration file say like sample.conf and having content like below

how can i monitor and display if something is modified on below content

VirtualToken = {
   VirtualToken00Label = HA_hktl;
   VirtualToken00SN = 1157803010;
   VirtualToken00Members = 157803010,155322014;
}
HASynchronize = {
   HA_HOL = 1;
}
HAConfiguration = {
   HAOnly = 1;
   haLogPath = /apps/hktl;
   logLen = 262144;
   haLogStatus = enabled;
   reconnAtt = 5;
}
hktl = {
  DefaultTimeOut = 200000;
  PEDTimeout1 = 100000;
  PEDTimeout2 = 100000;
  PEDTimeout3 = 10000;
  KeypairGenTimeOut = 3700000;
  CloningCommandTimeOut = 300000;
}