All Apps and Add-ons

Will the File/Directory Information Input add-on work on a universal forwarder?

a212830
Champion

Does the File/Directory app require a heavy forwarder? It appears to require python.

0 Karma
1 Solution

LukeMurphey
Champion

It does require a heavy forwarder. However, version 1.1 is being designed to eliminate the need for Splunk's Python and will work with the system's Python. See http://lukemurphey.net/issues/1068.

Note that this would still require Python on the host's system.

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

Don't forget about the fschange stanza available in basic splunk.
http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/Inputsconf

Of course, I assume you already know this and need something more advanced, otherwise @LukeMurphey wouldn't have written his app.

0 Karma

LukeMurphey
Champion

Part of the reason that this app exists is because fschange has been deprecated since 2012 (if I recall correctly). The input is going to be supported as long as Splunk 4.3 is supported; it might be removed then.

0 Karma

LukeMurphey
Champion

It does require a heavy forwarder. However, version 1.1 is being designed to eliminate the need for Splunk's Python and will work with the system's Python. See http://lukemurphey.net/issues/1068.

Note that this would still require Python on the host's system.

worshamn
Contributor

Now that this is at Version 1.2, will it now work on a universal forwarder? I have tried unsuccessfully to install it on a UF, but just wanted to make sure that it should or should not work.

0 Karma

LukeMurphey
Champion

As of version 1.3, it does support Universal Forwarder provided the host has Python available (Python 2.7 is recommended).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...