Splunk Search

Trying to use FSChange for monitoring filesystem, getting a ton of sources and sourcetypes

kholleran
Communicator

Hello,

I need to monitor a handful of application directories and system32 for changes. I utilized FSChange with regex's to isolate file types to monitor. I turned this on and all of a sudden I have over 100 sources and 30 sourcetypes! Is there a way to make all of these under one source and sourcetype? It appears each individual file is a different source type as opposed to a single fschange sourcetype.

Thanks for any help as there is so much its not very useful.

Thanks.

Kevin

0 Karma

kholleran
Communicator

I also was pulling the whole event as I misunderstood what that did. Now I have it working and apparently there is a bug where | delete does not get rid of the source & sourcetype so I have several hundred sources and sourcetypes that I don't want...

0 Karma

kholleran
Communicator

OK, I found the issue for the extra files I believe, it appears that in one of my whitelists I made a typo and forgot the opening bracket [.

So hopefully it is limiting its monitoring to just .exe, .dll, etc Is there a way to remove all those other sourcetypes and sources? Also, can all fschange related events be under a single source and sourcetype called fschange? Would I do this in transforms.conf?

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...