How to configure File/Directory Information Input on UFs?

[Spranta]

Hi all,

we have deployed the file_meta_data app on one of our universal forwarders running on windows 2012R2 because we want to monitor the file size for a specific file.

The inputs.conf looks like this

[file_meta_data://Trendmicro]
file_hash_limit = 300MB
file_path = C:\Program Files\Trend\SProtect\x64\SpntLog\SpntLog.dbf
include_file_hash = 0
index = egg_win_prod_90
interval = 1m
only_if_changed = 0
recurse = 1
sourcetype = File_Metadata
disabled=0

But it's not working and in the Splunkd.log I see the following error:

The file

2-27-2018 11:34:25.499 +0100 ERROR ModularInputs - Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified.
02-27-2018 11:34:25.499 +0100 ERROR ModularInputs - Unable to initialize modular input "file_meta_data"  defined inside the app "file_meta_data": Introspecting scheme=file_meta_data: Unable to run "python "C:\Program Files\SplunkUniversalForwarder\etc\apps\file_meta_data\bin\file_meta_data.py" --scheme": child failed to start: The system cannot find the file specified.

Has anyone an idea why we are getting this error?

Thanks
Alex

[Spranta]

Hi FrankVI,

thanks for your answer, thought the latest version is UF ready.
Version 1.3
Sept. 22, 2017
Added support for deploying on Universal Forwarders

Hm 😕

[FrankVl]

Yes, and the way he made it UF ready is by allowing the add on to use system python if there is not python available within splunk (as is the case on UF).

So yes: it works with UF, but it still requires python, so since UF doesn't supply python, you need to make sure python is installed separately.

[Spranta]

Thanks,

is there an app for the python support, just like powershell add on?

Alex

[FrankVl]

Don't think so. I think you just need to get the relevant installer from https://www.python.org/downloads/windows/ to install python on that server.

[FrankVl]

Universal Forwarders don't come with python (unlike heavy forwarder), so to make this work, you will need to make sure you have a working python installed on the host that is running this UF or use a Heavy Forwarder instead.