topic Re: File/Directory Information Input not working in Getting Data In

File/Directory Information Input not working

logtastic — Wed, 17 Feb 2021 18:39:55 GMT

Hello,

I have installed the File/Directory Information Input add-on to a Windows endpoint to test monitoring certain files. The Windows host has Python 2.x installed and I am having Splunk monitor a "test.txt" file under C:\Program Files\SplunkUniversalForwarder - so we theoretically shouldn't have any permission issues - please correct me if I am wrong.

The only change to the add-on was creating a local directory with a inputs.conf file:

[file_meta_data://default]
file_path = C:\Program Files\SplunkUniversalForwarder
interval = 1m
recurse = 1
only_if_changed = 1
include_file_hash = 0
file_hash_limit = 500MB
file_filter= test
index = main

I am seeing no logs, whats also interesting is that I am not seeing the file_meta_data_modular_input.log file either.

Where am I going wrong?

Re: File/Directory Information Input not working

richgalloway — Thu, 18 Feb 2021 14:08:42 GMT

Did you restart the forwarder after installing the app and modifying the inputs.conf file?

Do you see the forwarder's internal logs (splunkd.log, etc.)?

When you see no logs, how exactly are you trying to find them?

Re: File/Directory Information Input not working

logtastic — Thu, 18 Feb 2021 14:13:29 GMT

Did you restart the forwarder after installing the app and modifying the inputs.conf file?

-Yes

Do you see the forwarder's internal logs (splunkd.log, etc.)?

-Yes

When you see no logs, how exactly are you trying to find them?

-On the UF directly: C:\Program Files\SplunkUniversalForwarder\var\log\splunk