I am trying to monitor the change on a remote file share directory. I want to know when the file changed, who made the change if posside (uid is fine.) I have following config put in inputs.conf file:
in Splunkd log I got following error message
`10-27-2017 16:39:22.643 +1100 WARN FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time - //\\scabby\E$\Monitor
Any suggestion what is going on there?
The first thing I would do is check the spelling of the actual full route to the file. The character sequence //\\ looks suspicious to me, and I also wonder if E$ is intended to be literal.
Unsure if this is still required or unanswered by try this as it worked for us, patience may be need if the directory is large and a full restart of the UF if you're using one: