I've read all the suggestion on importing bash history logs and tried variation of fschange, followTail and ignoreOlderThan.  For user logs this works just fine: [monitor:///home/*/.bash_history] disabled = false sourcetype = bash_history index = linux followTail = 1 ignoreOlderThan = 1d   For root logs. Nothing works unless I monitor the whole file and that has no value to me since Splunk forwards the full log file each time a change occurs. So if the history size is 1000, then 1000 events are sent to splunk if I run a single "who" command. Any suggestions?  ... View more

Hello, I have installed the File/Directory Information Input add-on to a Windows endpoint to test monitoring certain files. The Windows host has Python 2.x installed and I am having Splunk monitor a "test.txt" file under C:\Program Files\SplunkUniversalForwarder - so we theoretically shouldn't have any permission issues - please correct me if I am wrong. The only change to the add-on was creating a local directory with a inputs.conf file: [file_meta_data://default] file_path = C:\Program Files\SplunkUniversalForwarder interval = 1m recurse = 1 only_if_changed = 1 include_file_hash = 0 file_hash_limit = 500MB file_filter= test index = main I am seeing no logs, whats also interesting is that I am not seeing the file_meta_data_modular_input.log file either. Where am I going wrong?  ... View more