The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
Stefan Baryakov's Discussions
fschange - change detection criteria
2 Replies
Hi All,How to only send the full event in case of user/group or hash change but not time change of file in the scope of fschange?As…Continue
Started this discussion. Last reply by Stefan Baryakov Jan 12, 2010.
Stefan Baryakov's Page
Gifts Received
Stefan Baryakov has not received any gifts yet
Latest Activity
Stefan Baryakov replied to Stefan Baryakov's discussion fschange - change detection criteria"Hi Michael,
Thanks for the response. The file is just being touched, as open and saved without being changed.
The hash in splunk desn't change however the complete file is indexed. When the files are really changed the hash changes and the…"
Michael Wilde replied to Stefan Baryakov's discussion fschange - change detection criteria"Stefan..
What is happening to the file? Is someone opening the file and saving it, so the modtime's getting updated? Or is someone just reading the file?
Also.. which OS is it on?"
Stefan Baryakov posted a discussionfschange - change detection criteria
Hi All,How to only send the full event in case of user/group or hash change but not time change of file in the scope of fschange?As example:[fschange:/etc/config.cfg]fullEvent=truesendEventMaxSize=-1Now every time the file is touched, even without change, the complete content of the file is indexed.In other words how to configure the [fschange] not to send ‘fullEvent’ in case of modtime change alone.Thank you.BR,StefanSee More
Michael Wilde left a comment for Stefan Baryakov"Stefan..
Thanks for signing up. I set up this site so we can freely share, discuss, ask questions, post videos.. whatever. Ask hard questions, and we'll try to get them answered.
Michael Wilde
Splunk Ninja"
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- n/a
Comment Wall (1 comment)
- At 8:16pm on January 7, 2010, Michael Wilde said…
- Stefan..
Thanks for signing up. I set up this site so we can freely share, discuss, ask questions, post videos.. whatever. Ask hard questions, and we'll try to get them answered.
Michael Wilde
Splunk Ninja
© 2012 Created by Michael Wilde.
