Hi @mhammett01,
It's not clear why you tagged "Lookup File Editor", the csv file to monitor is on a Universal Forwarder and must be indexed, is it correct?
let me understand:
- you have a Universal Forwarder installed on a Linux Server,
- on this server you have a csv to monitor,
- you want to monitor this file that's updated every day.
I can imagine that your UF are sending logs to Splunk Server so there aren't connection problems, you can simply test this using this search on your Splunk Server (if you have a stand-alone server) or on a Search Head (if you have a Distributed search):
index=_internal host=my_host
If you have results, connection is ok, otherwise you have to test the connection.
So you have to create an Add-On that contains a file called inputs.conf.
Have you a Deployment Server?
So deploy the Add-on on the Universal Forwarder manually or using the Deployment Server.
Anyway, in inputs.conf file there's a dedicated stanza like this:
[monitor:///my_path/my_file.csv]
index=my_index
disabled=0
sourcetype=my_sourcetype
If the name contains the date (e.g. my_file_2019-11-12.csv) you can use:
[monitor:///my_path/my_file*.csv]
In this way you have the input processor to take the file (remember that if you manually deploy the Add-On you have to restart Splunk on Universal Forwarder.
Put attention to the rights on the file: the user running splunkd process must be enabled to read the file.
Ciao.
Giuseppe
