Getting Data In

NOOB - fschange setup not working

skopy
Engager

sorry for noob question, i am using splunk for 2 days...
i am pulling my hair out, cant get it to work....

i have setup an index fschange_test

added this to local/inputs.conf

[fschange:/etc]
index = fschange_test
recurse = true
followLinks = false
signedaudit = false
fullEvent = true

splunk restarted

changed a few files, added some in /etc...

so i go to search type

index="fschange_test"

and get 0 matching events...
the same goes if i add or change some files in splunks /etc dir whitch should work by default...

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi skopy

you will love splunk the more you use it 😉

does your user which runs splunkd have read access to /etc?
what can be found if you search index=_internal source="*splunkd.log*" for /etc?

as you already have found answer.splunk.com; another great source is splunk docs

cheers>

View solution in original post

skopy
Engager

i managed to get it running and currently running a battle with blacklist excluding folders on recurse, so i think i will have to go harder way; not to include what i want, but exclude what i dont want....

thanks for your time to answer 😃

MuS
SplunkTrust
SplunkTrust

hi skopy, you could accept the answer so it will be marked as answered.....and have fun with splunk 🙂

MuS>

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi skopy

you will love splunk the more you use it 😉

does your user which runs splunkd have read access to /etc?
what can be found if you search index=_internal source="*splunkd.log*" for /etc?

as you already have found answer.splunk.com; another great source is splunk docs

cheers>

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...