topic Re: Will the File/Directory Information Input add-on work on a universal forwarder? in All Apps and Add-ons

Will the File/Directory Information Input add-on work on a universal forwarder?

a212830 — Thu, 29 Oct 2015 21:49:54 GMT

Does the File/Directory app require a heavy forwarder? It appears to require python.

Re: Will the File/Directory Information Input add-on work on a universal forwarder?

LukeMurphey — Thu, 29 Oct 2015 21:54:57 GMT

It does require a heavy forwarder. However, version 1.1 is being designed to eliminate the need for Splunk's Python and will work with the system's Python. See http://lukemurphey.net/issues/1068.

Note that this would still require Python on the host's system.

Re: Will the File/Directory Information Input add-on work on a universal forwarder?

worshamn — Thu, 14 Sep 2017 16:07:17 GMT

Now that this is at Version 1.2, will it now work on a universal forwarder? I have tried unsuccessfully to install it on a UF, but just wanted to make sure that it should or should not work.

Re: Will the File/Directory Information Input add-on work on a universal forwarder?

LukeMurphey — Fri, 22 Sep 2017 07:01:32 GMT

As of version 1.3, it does support Universal Forwarder provided the host has Python available (Python 2.7 is recommended).

Re: Will the File/Directory Information Input add-on work on a universal forwarder?

sloshburch — Tue, 02 Jul 2019 15:33:39 GMT

Don't forget about the fschange stanza available in basic splunk.
http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf

Of course, I assume you already know this and need something more advanced, otherwise @LukeMurphey wouldn't have written his app.

Re: Will the File/Directory Information Input add-on work on a universal forwarder?

LukeMurphey — Tue, 02 Jul 2019 15:33:40 GMT

Part of the reason that this app exists is because fschange has been deprecated since 2012 (if I recall correctly). The input is going to be supported as long as Splunk 4.3 is supported; it might be removed then.