Deployment Architecture

Are there any reasons to setup both monitor and fschange on the same path?

Lowell
Super Champion

Are there any reason to setup both [monitor://] and a [fschange:] inputs for a single path? Are there any problems with doing this, and if not, what would be the advantages to such a configuration?

I ask this because I notice that Splunk's unix app does this in both Splunk 4.0.10 and Splunk 4.1.1.

Snipet from inputs.conf:

[fschange:/etc]
index=os
pollPeriod = 300
fullEvent = true
filesPerDelay=5
delayInMills=100

[monitor:///etc]
_whitelist=(\.conf|\.cfg|config$|\.ini|\.init|\.cf|\.cnf|shrc$|^ifcfg|\.profile|\.rc|\.rules|\.tab|tab$|\.login|policy$)
index=os

In 4.0, both of the inputs are enabled by default (once you enable the unix app, of course). In 4.1 the unix app has all inputs disabled by default (which is a more sane default, IMHO). Either way, both stanzas are there.

dwaddle
SplunkTrust
SplunkTrust

According to the docs for inputs.conf, this is not supported.

NOTE: You cannot simultaneously watch a directory using fs change monitor and monitor (above).

But, that said, the unix app does configure both inputs in spite of the docs saying it can't be done.

Lowell
Super Champion

So, any idea on why this is done, what advantage it provides?

0 Karma

jrodman
Splunk Employee
Splunk Employee

I think our preclusion of this behavior is basically stale. Given that we do it all over the place, and I think customers are doing it, it does work.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...