Monitoring deploymentclient.conf in etc\system

krishnab · ‎04-27-2018

Is it possible to monitor the folder in etc/system which consists the deployment client ip thru windows app/add-on.

I tried this but not working.

[monitor://C:\Program Files\SplunkUniversalForwarder\etc\system\local\deploymentclient.conf]
disabled = 0
interval = 60
sourcetype = DSIP
index = perfmon

jajung · ‎04-27-2018

Hi krishnab,

Could you please share with us what you're trying to do with the deployment server's IP? There are a number of ways to achieve this without having to monitor the file for ingestion!

Monitoring deploymentclient.conf in etc\system

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation

Monitoring deploymentclient.conf in etc\system

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent