Getting Data In
Highlighted

Will a universal-forwarder monitor a newly created subdirectory while it's already running, or do I need to restart the forwarder?

Champion

Hi,

Will a universal forwarder pick up a newly created subdirectory after it's already running?

For example, I'm monitoring /apps/logs/ with a recursive statement and a whitelist. If a new sub-directory gets created after the forwarder is running, will it monitor it? Or, do I need to restart the UFW?

0 Karma
Highlighted

Re: Will a universal-forwarder monitor a newly created subdirectory while it's already running, or do I need to restart the forwarder?

Contributor

It will pick it up, as long as the recursive optiont is enabled and it matches the whitelist and blacklist

Highlighted

Re: Will a universal-forwarder monitor a newly created subdirectory while it's already running, or do I need to restart the forwarder?

Path Finder

@mzorzi - im having the same issue. how can i configure the inputs.conf to have it recursive?

0 Karma
Highlighted

Re: Will a universal-forwarder monitor a newly created subdirectory while it's already running, or do I need to restart the forwarder?

SplunkTrust
SplunkTrust

And don't forget file system permissions; if the Splunk user is not able to read the new directory, it will never be picked up.......

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.