All Apps and Add-ons

Monitoring a Remote Directory for Changes WITHOUT Ingesting files into Splunk?

New Member

HI All,

Long story short - I'm looking to monitor a remote directory for changes/new files/changes to files and send this information to Splunk. To re-emphasize, due to the nature of these files, I do NOT want to ingest the files themselves into Splunk. Metadata like, size, paths, owners, changes, etc. is what I am looking for.

I have discovered and set up Luke Murphey's "File/Directory Input" App -

However - After configuration, I'm not seeing anything come into Splunk...

M example path within this app on my Splunk Server (say is set to something like this for my remote server directory:

Is this app capable of doing that remotely?

Should this path be something like user@ip:/path/to/folder ? Wouldn't I need ssh keys of sorts to do this?


If this app isn't the solution...

Is a Universal Forwarder able to be configured to do this monitoring and forward metadata without forwarding the files themselves?


Thanks in advance for any help.

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...