I just need some help in understanding what is possible. I have a powershell script that I use to gather data from active directory. The powershell script generates a CSV file that I monitor with SPLUNK. SPLUNK is configured to monitor the file. This is on our old AIO (all in one) instance and I have built a new instance with the aim to retire the old AIO. Both these systems are online at the same time and will run parallel until everything is eventually cut over, meaning I can't impact the old system but need the monitored files on the new deployment.
The old instance has a folder (its Windows) that is "D:\FileMonitor". The new instance is a Centos build.
Without impacting the old AIO how do I get the new instance to reference this file? I thought that maybe writing a new app and just creating an inputs.conf file along with an outputs.conf file should do the trick. Would this work without impacting the old AIO but letting me get my data in the new instance? Reading articles such as "https://answers.splunk.com/answers/471936/install-both-universal-forwarder-and-splunk-enterp.html" (Install both Universal Forwarder and Splunk Enterprise on on same Windows server in case the link doesn't show) suggests not to install both the UF and Enterprise on the same server.
