HI All,
Long story short - I'm looking to monitor a remote directory for changes/new files/changes to files and send this information to Splunk. To re-emphasize, due to the nature of these files, I do NOT want to ingest the files themselves into Splunk. Metadata like, size, paths, owners, changes, etc. is what I am looking for.
I have discovered and set up Luke Murphey's "File/Directory Input" App - https://splunkbase.splunk.com/app/2776
However - After configuration, I'm not seeing anything come into Splunk...
M example path within this app on my Splunk Server (say 10.10.10.10) is set to something like this for my remote server directory:
10.10.10.20:/directory/to/watch/
Is this app capable of doing that remotely?
Should this path be something like user@ip:/path/to/folder ? Wouldn't I need ssh keys of sorts to do this?
If this app isn't the solution...
Is a Universal Forwarder able to be configured to do this monitoring and forward metadata without forwarding the files themselves?
Thanks in advance for any help.
