Getting Data In

FSChange: fullEvent=true but no full event?

muebel
SplunkTrust
SplunkTrust

I have a fschange stanza configured as such

[fschange:/path/to/file]
disabled = false
pollPeriod = 300
fullEvent = true
hashMaxSize = 65535

It seems to be detecting changes to this file, but doesn't include the file as I am expecting fullEvent = true would do. What am I missing?

Tags (2)
1 Solution

Simeon
Splunk Employee
Splunk Employee

If something changed, you should see the file displayed depending on the search criteria. The best way to find it would be to search for:

index=* source=/path/to/file*

I would be curious to know the exact fschangemonitor output when you run your initial search. Additionally, you may have the sendEventMaxSize set to something too low. If you set it to -1 under the stanza, it should pick up the file:

sendEventMaxSize=-1

View solution in original post

Simeon
Splunk Employee
Splunk Employee

If something changed, you should see the file displayed depending on the search criteria. The best way to find it would be to search for:

index=* source=/path/to/file*

I would be curious to know the exact fschangemonitor output when you run your initial search. Additionally, you may have the sendEventMaxSize set to something too low. If you set it to -1 under the stanza, it should pick up the file:

sendEventMaxSize=-1

muebel
SplunkTrust
SplunkTrust

I misunderstood how this was working out... did a search for the file as a source, and was able to see the full file there.

muebel
SplunkTrust
SplunkTrust

sendEventMaxSize defaults to -1

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...