Monitoring a file from a PC

Manual by editing agent on the machine you want to monitor

File location

C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local\input.config

If in the installer you have it monitoring the event viewer alerts the file should contain

To monitor the file location add this to the above file

[monitor://C:\Users\j.hollon\Desktop\moniterMe]

disabled = false

index = <name me>

sourcetype = <anything>

recursive = true

Log to see if it is sending to splunk indexer

C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log

Resources

Audit File Access and Change in Windows | SplunkSplunk

https://docs.splunk.com/Documentation/SplunkCloud/9.2.2403/Data/MonitorfilesystemchangesonWindows#Examples_of_file_system_change_monitoringdocs.splunk.com