https://community.splunk.com/t5/Getting-Data-In/Windows-How-to-get-fs-notification-source-type-data-into-Splunk/m-p/322344#M93473 <P>I'm not sure what you mean with how much time it should take?<BR /> You mean for events getting ingested into splunk? Is it not working at all?<BR /> Have you restarted the UF?</P> <P>the fschange function has been deprecated btw. See:<BR /> <A href="https://answers.splunk.com/answers/63874/why-is-fschange-file-system-change-monitor-a-deprecated-feature-in-splunk-5-0.html">https://answers.splunk.com/answers/63874/why-is-fschange-file-system-change-monitor-a-deprecated-feature-in-splunk-5-0.html</A></P> <P>Have a look at this:<BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesystemchangesonWindows">http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesystemchangesonWindows</A></P> Mon, 22 Jan 2018 11:59:12 GMT Azeemering 2018-01-22T11:59:12Z https://community.splunk.com/t5/Getting-Data-In/Windows-How-to-get-fs-notification-source-type-data-into-Splunk/m-p/322343#M93472 <P>Windows: How to get fs_notification source type data into Splunk?</P> <P>Current configuration of inputs.conf</P> <P>[fschange:$SPLUNK_HOME\var\log]<BR /> signedaudit = false<BR /> index=Dksoni</P> <P>How much time it would take to get this source type data into splunk ?</P> Mon, 22 Jan 2018 09:39:50 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-How-to-get-fs-notification-source-type-data-into-Splunk/m-p/322343#M93472 dsoni_splunk 2018-01-22T09:39:50Z https://community.splunk.com/t5/Getting-Data-In/Windows-How-to-get-fs-notification-source-type-data-into-Splunk/m-p/322344#M93473 <P>I'm not sure what you mean with how much time it should take?<BR /> You mean for events getting ingested into splunk? Is it not working at all?<BR /> Have you restarted the UF?</P> <P>the fschange function has been deprecated btw. See:<BR /> <A href="https://answers.splunk.com/answers/63874/why-is-fschange-file-system-change-monitor-a-deprecated-feature-in-splunk-5-0.html">https://answers.splunk.com/answers/63874/why-is-fschange-file-system-change-monitor-a-deprecated-feature-in-splunk-5-0.html</A></P> <P>Have a look at this:<BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesystemchangesonWindows">http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesystemchangesonWindows</A></P> Mon, 22 Jan 2018 11:59:12 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-How-to-get-fs-notification-source-type-data-into-Splunk/m-p/322344#M93473 Azeemering 2018-01-22T11:59:12Z