Hi,
I know that there is an article about fschange depreciated, but it's still exists in splunk 9.x.x.
I was wondering if anyone has this issue where the host = $decideOnStartup when using fschange, and possible how to fix it. This only happened to fschange for me.
Also, any insight on alternatives to fschange is appreciated it.
[fschange:/root/somefile]
disabled = false
index = fs_change
recurse = true
pollPeriod = 30
sourcetype = fs_change
thank you.
