I have two copies of inputs.conf, one is under the etc/apps/local directory ( created the local and placed inputs.conf) , now the inputs.conf in the apps directory is actually a copy of the inputs.conf from system/local with minor modifications and additional parameters,
now I am tryin to monitor /root/.bash_history/.
this monitor works fine if I place it under /etc/system/local/inputs.conf
but if i place it inside /apps/local/ , it doesnt work fine, and the same holds true for few other fschange parameters like /home, /etc
any idea? I have placed the ownership for all these under splunk only ..