I know that there is an article about fschange depreciated, but it's still exists in splunk 9.x.x.
I was wondering if anyone has this issue where the host = $decideOnStartup when using fschange, and possible how to fix it. This only happened to fschange for me.
Also, any insight on alternatives to fschange is appreciated it.
[fschange:/root/somefile]disabled = falseindex = fs_changerecurse = truepollPeriod = 30sourcetype = fs_change