Getting Data In

Windows Folder Monitoring

6nelson8
New Member

How to monitor Windows folder path, send alert if no data is written to the said shared folder or windows path?

0 Karma

6nelson8
New Member

Hi Koshyk, i will try your suggestion. I will keep you posted.

thank you.

0 Karma

koshyk
Super Champion

You could do it easily in SPL I thought for this. Just do the normal monitoring of the directory/folder. in SPL, just search if no update has been made to any file in last xx minutes
inputs.conf

[monitor://D:\somedir\somedir2\]
disabled = false
index = my_index
sourcetype = my:monitor:sourcetype

and in your SPL do something

index=my_index sourcetype=my:monitor:sourcetype earliest=-30m latest=now 
|stats count by sourcetype
| appendpipe [ stats count  | where count=0 | eval host="EMPTY"  ]
| search sourcetype=EMPTY

So if its empty trigger an alert or some logic

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...