Getting Data In

File/Directory Information Input not working

logtastic
Explorer

Hello,

I have installed the File/Directory Information Input add-on to a Windows endpoint to test monitoring certain files. The Windows host has Python 2.x installed and I am having Splunk monitor a "test.txt" file under C:\Program Files\SplunkUniversalForwarder - so we theoretically shouldn't have any permission issues - please correct me if I am wrong.

The only change to the add-on was creating a local directory with a inputs.conf file:

[file_meta_data://default]
file_path = C:\Program Files\SplunkUniversalForwarder
interval = 1m
recurse = 1
only_if_changed = 1
include_file_hash = 0
file_hash_limit = 500MB
file_filter= test
index = main

I am seeing no logs, whats also interesting is that I am not seeing the file_meta_data_modular_input.log file either.

Where am I going wrong? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart the forwarder after installing the app and modifying the inputs.conf file?

Do you see the forwarder's internal logs (splunkd.log, etc.)?

When you see no logs, how exactly are you trying to find them?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

logtastic
Explorer

Did you restart the forwarder after installing the app and modifying the inputs.conf file?

-Yes

Do you see the forwarder's internal logs (splunkd.log, etc.)?

-Yes

When you see no logs, how exactly are you trying to find them?

-On the UF directly: C:\Program Files\SplunkUniversalForwarder\var\log\splunk

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!