First off, I'm new to splunk so I apologize if I'm asking basic questions.
I'm trying to use the deployment server to deploy an app that will watch a specific file on a set of Windows boxes. My problem is that although the changes are being correctly recorded, the actual file is being broken up into multiple events, instead of one event for the whole file.
Here's the basic setup. I have a number of boxes that contain 4 Folders with a config file inside.
Part of my setup is working, because I'm successfully getting change notifications, and those are classified correctly as sourcetype 'folder_monitor'. The part I can't get to work is that my .ini files are showing up as individual lines, instead of one event per file.
My first question is where are the actual props actions taking place? Is it on the UF, or does my main splunk indexer require the same props.conf elements? If the main index requires the same elements, should they be located under the $SPLUNK_HOME$/etc/apps/ directory for my application, or under $SPLUNK_HOME$/etc/system/local ?
Second, I've found a lot of splunk-base questions on similar issues. Seems like there have been some bugs around the fschange type, so does anyone know if these have been resolved in the latest build? I'm running 4.3.3 , build 128297.