How do I fix fschange getting host = $decideOnSta...

Monitoring Splunk

Hi,

I know that there is an article about fschange depreciated, but it's still exists in splunk 9.x.x.

I was wondering if anyone has this issue where the host = $decideOnStartup when using fschange, and possible how to fix it. This only happened to fschange for me.

Also, any insight on alternatives to fschange is appreciated it.

[fschange:/root/somefile]
disabled = false
index = fs_change
recurse = true
pollPeriod = 30
sourcetype = fs_change

thank you.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...