FSChange question

[hannanp]

I am just getting this started and trying to figure out why it is not bringing in events. I have the inputs.conf file on the local box that splunk is running on just for a test.

In that file I have [fschange:/opt/Tivoli]

Save the file, restart splunk. It should be getting sent to the main index by default if I read correctly. Files are getting changed in one of the subdirectories but nothing is coming in from them.

Am I missing a bit of a config thing?

Thanks!

[TOPFiveSoftware]

http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Inputsconf

Use
[monitor://opt/Tivoli]
sourcetype=yoursourcetype

[hannanp]

I changed this in the inputs.conf file on a server that is otherwise sending in information. From what I can see when I restart Splunk after changing it, it reads the files in the directory but then never reads them again. I set the pollPeriod=60. Any ideas why it wouldn't keep polling for some reason?

[linu1988]

What do you want to monitor? The change in FileSystem or any change to specific logs? As fschange is now depriciated, you need to use scripts to monitor the filesystem change/monitor stanza.

[bmacias84]

fschange is being depricated in 5.x.