Trying to have a CSV sent every evening probably use a schedule job to update. Using UF to monitor a folder doesnt seem to work, unless someone has been able to do that. Any assistance would be awesome. Cheers!
It's not clear why you tagged "Lookup File Editor", the csv file to monitor is on a Universal Forwarder and must be indexed, is it correct?
let me understand:
you have a Universal Forwarder installed on a Linux Server,
on this server you have a csv to monitor,
you want to monitor this file that's updated every day.
I can imagine that your UF are sending logs to Splunk Server so there aren't connection problems, you can simply test this using this search on your Splunk Server (if you have a stand-alone server) or on a Search Head (if you have a Distributed search):
If you have results, connection is ok, otherwise you have to test the connection.
So you have to create an Add-On that contains a file called inputs.conf.
Have you a Deployment Server?
So deploy the Add-on on the Universal Forwarder manually or using the Deployment Server.
Anyway, in inputs.conf file there's a dedicated stanza like this: