Getting Data In

Windows Folder Monitoring

6nelson8
New Member

How to monitor Windows folder path, send alert if no data is written to the said shared folder or windows path?

0 Karma

6nelson8
New Member

Hi Koshyk, i will try your suggestion. I will keep you posted.

thank you.

0 Karma

koshyk
Super Champion

You could do it easily in SPL I thought for this. Just do the normal monitoring of the directory/folder. in SPL, just search if no update has been made to any file in last xx minutes
inputs.conf

[monitor://D:\somedir\somedir2\]
disabled = false
index = my_index
sourcetype = my:monitor:sourcetype

and in your SPL do something

index=my_index sourcetype=my:monitor:sourcetype earliest=-30m latest=now 
|stats count by sourcetype
| appendpipe [ stats count  | where count=0 | eval host="EMPTY"  ]
| search sourcetype=EMPTY

So if its empty trigger an alert or some logic

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...