topic Does fschange input work with Universal Forwarder? in Getting Data In

Does fschange input work with Universal Forwarder?

maverick — Thu, 14 Jul 2011 17:33:20 GMT

If I enable fschange input on my Splunk Universal Forwarder, will it work the same as on a regular forwarder?

Re: Does fschange input work with Universal Forwarder?

jbsplunk — Thu, 14 Jul 2011 17:52:37 GMT

Yes. I've done some testing, and from what I can tell fschange behaves normally on a UF.

Re: Does fschange input work with Universal Forwarder?

Simeon — Wed, 18 Apr 2012 16:19:30 GMT

This might not be supported per the docs:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorchangestoyourfilesystem#How_the_file_system_change_monitor_works

Re: Does fschange input work with Universal Forwarder?

Masa — Fri, 20 Apr 2012 19:24:05 GMT

In order to make a UF to forward fschange events, please configure "signedaudit = false" and "index = "

Here is an example



[fschange://<your path>]

signedaudit = false

index=_audit

At the indexer, you can search these fschange events with sourcetype="fs_notification" or source="fschangemonitor"

As long as I understand, this is a bug. So, we're going to document this as a workaround in our doc.

Re: Does fschange input work with Universal Forwarder?

sdaniels — Fri, 20 Apr 2012 19:39:32 GMT

Mav - If you only want to forward change events (and not the file), the UF will not work. Apparently it needs to send the whole file in order to send the change events. Saw this in a thread recently.