Getting Data In

fschange, file system change detection not working, how do I verify?


I have changed input.conf and restarted Spulnk, but I can't see any event generated for changing /etc/hosts file.

The the procedure was

  1. Added inputs.conf for fschange conf.
  2. Restarted Splunk.
  3. Changed /etc/hosts file to see splunk generated event
  4. logined to Splunk for fschange log.

And the I coould find the fs change log. Am I missing any procedure?


[root@splunk local]# pwd
[root@splunk local]# cat inputs.conf
host = splunk


=====================Splunk Restarted

Tags (1)

Splunk Employee
Splunk Employee

Are you searching for something like this?

index=os source="fschangemonitor" path=*hosts*

Splunk Employee
Splunk Employee

If that search doesn't return results, what Splunk & OS version are you using?

0 Karma