https://community.splunk.com/t5/Getting-Data-In/Monitor-Files-and-Directories-configured-but-nothing-is-indexing/m-p/558762#M92431 <P>First, having two consecutive [monitor://...] lines does not create two monitors with the same settings.&nbsp; The first monitor uses only default settings, whereas the second uses those specified in the stanza.</P><P>Second, check splunkd.log to confirm it, but I suspect nothing is ingested because .docx files are binary and Splunk doesn't ingest non-textual data.</P><P>Finally, it looks like you want to detect when these files change rather than index the files themselves.&nbsp; If so, use an fschange input.&nbsp; See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorchangestoyourfilesystem" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorchangestoyourfilesystem</A></P> Thu, 08 Jul 2021 20:44:00 GMT richgalloway 2021-07-08T20:44:00Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Files-and-Directories-configured-but-nothing-is-indexing/m-p/558756#M92430 <P>File Monitor configured - but nothing is indexing ?</P><P>here is my inputs.conf&nbsp;</P><P>[monitor://C:\xxxx\xxxxxx\xxxxxxx\xxxxx.docx]<BR />[monitor://C:\xxxxx\xxxxxxx\xxxxxx.docx]<BR />disabled = 0<BR />index=file_integrity_monitoring<BR />sourcetype=test<BR />crcSalt=&lt;SOURCE&gt;</P><P>following the article below in our Splunk Cloud environment.</P><P>&nbsp;<BR /><A href="https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorfilesanddirectorieswithinputs.conf" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorfilesanddirectorieswithinputs.conf</A></P><P>Any idea what is missing ?&nbsp;</P> Thu, 08 Jul 2021 19:56:51 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Files-and-Directories-configured-but-nothing-is-indexing/m-p/558756#M92430 Alfred 2021-07-08T19:56:51Z https://community.splunk.com/t5/Getting-Data-In/Monitor-Files-and-Directories-configured-but-nothing-is-indexing/m-p/558762#M92431 <P>First, having two consecutive [monitor://...] lines does not create two monitors with the same settings.&nbsp; The first monitor uses only default settings, whereas the second uses those specified in the stanza.</P><P>Second, check splunkd.log to confirm it, but I suspect nothing is ingested because .docx files are binary and Splunk doesn't ingest non-textual data.</P><P>Finally, it looks like you want to detect when these files change rather than index the files themselves.&nbsp; If so, use an fschange input.&nbsp; See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorchangestoyourfilesystem" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Monitorchangestoyourfilesystem</A></P> Thu, 08 Jul 2021 20:44:00 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-Files-and-Directories-configured-but-nothing-is-indexing/m-p/558762#M92431 richgalloway 2021-07-08T20:44:00Z