Getting Data In

File/Directory Information Input not working

logtastic
Explorer

Hello,

I have installed the File/Directory Information Input add-on to a Windows endpoint to test monitoring certain files. The Windows host has Python 2.x installed and I am having Splunk monitor a "test.txt" file under C:\Program Files\SplunkUniversalForwarder - so we theoretically shouldn't have any permission issues - please correct me if I am wrong.

The only change to the add-on was creating a local directory with a inputs.conf file:

[file_meta_data://default]
file_path = C:\Program Files\SplunkUniversalForwarder
interval = 1m
recurse = 1
only_if_changed = 1
include_file_hash = 0
file_hash_limit = 500MB
file_filter= test
index = main

I am seeing no logs, whats also interesting is that I am not seeing the file_meta_data_modular_input.log file either.

Where am I going wrong? 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart the forwarder after installing the app and modifying the inputs.conf file?

Do you see the forwarder's internal logs (splunkd.log, etc.)?

When you see no logs, how exactly are you trying to find them?

---
If this reply helps you, Karma would be appreciated.
0 Karma

logtastic
Explorer

Did you restart the forwarder after installing the app and modifying the inputs.conf file?

-Yes

Do you see the forwarder's internal logs (splunkd.log, etc.)?

-Yes

When you see no logs, how exactly are you trying to find them?

-On the UF directly: C:\Program Files\SplunkUniversalForwarder\var\log\splunk

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...