The dojo of Splunk. Learn, share, teach, mentor.
-
Stefan Baryakov
- praha
- Czech Republic
- Share
- Share on Twitter
- Share on Facebook
- Blog Posts
- Discussions (2)
- Events
- Videos
Stefan Baryakov's Discussions
fschange - change detection criteria
2 Replies
Hi All, How to only send the full event in case of user/group or hash change but not time change of file in the scope of fschange? As example: [fschange:/etc/config.cfg] fullEvent=true every time th…
Started this discussion. Last reply by Stefan Baryakov Jan 12.
Stefan Baryakov's Page
Gifts Received
Stefan Baryakov has not received any gifts yet
Latest Activity
Hi Michael,
Thanks for the response. The file is just being touched, as open and saved without being changed.
The hash in splunk desn't change however the complete file is indexed. When the files are really changed the hash changes and the file is…
Stefan..
What is happening to the file? Is someone opening the file and saving it, so the modtime's getting updated? Or is someone just reading the file?
Also.. which OS is it on?
Hi All,
How to only send the full event in case of user/group or hash change but not time change of file in the scope of fschange?
As example:
[fschange:/etc/config.cfg]
fullEvent=true
sendEventMaxSize=-1
Now every time the file is touched, even wi…
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- n/a
Comment Wall (1 comment)
- At 8:16pm on January 7, 2010,
Michael Wilde said…
- Stefan..
Thanks for signing up. I set up this site so we can freely share, discuss, ask questions, post videos.. whatever. Ask hard questions, and we'll try to get them answered.
Michael Wilde
Splunk Ninja
Videos
Latest Splunk Community Postings
© 2010 Created by Michael Wilde.
Powered by 
.
