topic FSChange question in Getting Data In

FSChange question

hannanp — Tue, 23 Jul 2013 21:00:05 GMT

I am just getting this started and trying to figure out why it is not bringing in events. I have the inputs.conf file on the local box that splunk is running on just for a test.

In that file I have [fschange:/opt/Tivoli]

Save the file, restart splunk. It should be getting sent to the main index by default if I read correctly. Files are getting changed in one of the subdirectories but nothing is coming in from them.

Am I missing a bit of a config thing?

Thanks!

Re: FSChange question

bmacias84 — Tue, 23 Jul 2013 22:32:01 GMT

fschange is being depricated in 5.x.

Re: FSChange question

linu1988 — Wed, 24 Jul 2013 09:18:33 GMT

What do you want to monitor? The change in FileSystem or any change to specific logs? As fschange is now depriciated, you need to use scripts to monitor the filesystem change/monitor stanza.

Re: FSChange question

TOPFiveSoftware — Wed, 24 Jul 2013 09:25:08 GMT

http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf

Use
[monitor://opt/Tivoli]
sourcetype=yoursourcetype

Re: FSChange question

hannanp — Wed, 24 Jul 2013 13:45:02 GMT

I changed this in the inputs.conf file on a server that is otherwise sending in information. From what I can see when I restart Splunk after changing it, it reads the files in the directory but then never reads them again. I set the pollPeriod=60. Any ideas why it wouldn't keep polling for some reason?