I am trying to monitoring the change on a remote file share directory. I want to know when the file changed, who made the change if posside (uid is fine.) I have following config put in input.conf file
[fschange://\\servername\E$\Monitor\]
index=sservice
pollPeriod=60
fullEvent=ture
sourcetype=MonitorDir
in Splunkd log I got following error message
`10-27-2017 16:39:22.643 +1100 WARN FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time - //\\scabby\E$\Monitor
Any suggestion what is going on there?
Thanks
↧