I'm not being able to find consice information, since every post just links to this DEPRECATED feature: docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem
I want to be able to log (and then alert) if a change is noticed in a file (usually implemented via scheduled hash checks, but it doesn't matter). Is that possible, or not any more and I would need to pay for other services for that feature?
The other doc that gets usually linked is this: docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesystemchangesonWindows
but the instructions make it seem like I can't use a Universal Forwarder and I must have another full fledged installation of splunk enterprise?
also the instructions have a crucial step where they link to a Microsoft Doc, but that link is completely dead, so it's missing instructions.
Can someone please clarify all this mess for me? I would really appreciate it.