HI, i have added below in inputs.conf file it is not showing the changes after updating sample.conf file and using below search command index=file_monitor sourcetype=fschange | diff diffheader=true | highlight +,- inputs.conf [fschange://home/splunk/config] disabled = 0 host = 12b8-spnfwd03 index = file_monitor recurse = true pollPeriod = 1 fullEvent = true sendEventMaxSize = -1 hashMaxSize = 99999999 sourcetype = fschange [monitor:///home/splunk/config/sample.conf] followTail = 0 host = 12b8-spnfwd03 disabled = false index = file_monitor sourcetype = fschange ... View more

Hi, i am talking about configuration file say like sample.conf and having content like below how can i monitor and display if something is modified on below content VirtualToken = { VirtualToken00Label = HA_hktl; VirtualToken00SN = 1157803010; VirtualToken00Members = 157803010,155322014; } HASynchronize = { HA_HOL = 1; } HAConfiguration = { HAOnly = 1; haLogPath = /apps/hktl; logLen = 262144; haLogStatus = enabled; reconnAtt = 5; } hktl = { DefaultTimeOut = 200000; PEDTimeout1 = 100000; PEDTimeout2 = 100000; PEDTimeout3 = 10000; KeypairGenTimeOut = 3700000; CloningCommandTimeOut = 300000; } ... View more