Getting Data In

Can I monitor change on a remote file share directory?

samlinsongguo
Communicator

I am trying to monitor the change on a remote file share directory. I want to know when the file changed, who made the change if posside (uid is fine.) I have following config put in inputs.conf file:

[fschange://\\servername\E$\Monitor\]
index=sservice
pollPeriod=60
fullEvent=ture
sourcetype=MonitorDir

in Splunkd log I got following error message

`10-27-2017 16:39:22.643 +1100 WARN  FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time - //\\scabby\E$\Monitor

Any suggestion what is going on there?
Thanks

0 Karma

paulbannister
Communicator

Unsure if this is still required or unanswered by try this as it worked for us, patience may be need if the directory is large and a full restart of the UF if you're using one:

[fschange:\servername\E$\Monitor]
index=sservice
sourcetype=MonitorDir
fullEvent=true
pollPeriod=60
recurse=true
sendEventMaxSize=100000
signedaudit=false
disabled=0

DalJeanis
Legend

The first thing I would do is check the spelling of the actual full route to the file. The character sequence //\\ looks suspicious to me, and I also wonder if E$ is intended to be literal.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...