Hello, I use Splunk as Indexer and deployment server und I have one universal forwarder installed. I'm getting an error, when Splunk forwarder tries to read one log file: Ignoring file '/mnt/scn_data/log.txt' due to: binary It works, after I put a file props.conf into app folder on the forwarder. [cx_scan_logs] CHARSET = UTF-16LE LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true category = Custom But after I made changes on the index server, the files on the forwarder like inputs.conf are updated and props.conf is deleted. And I get the error again. How can I say the Splunk not to delete the props.conf on the forwarder?
... View more