Getting Data In

fschange, file system change detection not working, how do I verify?

clyde772
Communicator

I have changed input.conf and restarted Spulnk, but I can't see any event generated for changing /etc/hosts file.

The the procedure was

  1. Added inputs.conf for fschange conf.
  2. Restarted Splunk.
  3. Changed /etc/hosts file to see splunk generated event
  4. logined to Splunk for fschange log.

And the I coould find the fs change log. Am I missing any procedure?

=====================================

[root@splunk local]# pwd
/opt/splunk/etc/system/local
[root@splunk local]# cat inputs.conf
[default]
host = splunk

[fschange:/etc]
index=os
recurse=true
followLinks=true
pollPeriod=60
fullEvent=true

=====================Splunk Restarted

Tags (1)

bwooden
Splunk Employee
Splunk Employee

Are you searching for something like this?

index=os source="fschangemonitor" path=*hosts*

bwooden
Splunk Employee
Splunk Employee

If that search doesn't return results, what Splunk & OS version are you using?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...