topic How to monitor a file within a VM? in Getting Data In

How to monitor a file within a VM?

cmccoy — Tue, 13 Apr 2010 23:26:01 GMT

How do you configure Splunk to monitor files within a VM? I installed Splunk within a VM and added a data input to monitor the file changes to a series of files. When I view the data input on the Files and Directories page it does show that it is monitoring a number of files but nothing is ever indexed. Is there a different procedure to monitor files that are within a VM?

Re: How to monitor a file within a VM?

mayler — Wed, 14 Apr 2010 00:49:30 GMT

So when you go into Search, Status, Inputs...you see data. But when you go into Search, Status, Index Activity...you don't see anything?

I created a File/Directory input as well. Do you have a whitelist or blacklist configured?

Re: How to monitor a file within a VM?

gkanapathy — Wed, 14 Apr 2010 01:04:38 GMT

Should be the same. Is it possible you don't have enough space on the VM data volume so that indexing pauses?

Re: How to monitor a file within a VM?

jrodman — Sat, 17 Apr 2010 08:14:43 GMT

There is nothing particular about VMs here. Splunk needs to be running in an environment where it can access the log files by the path that you specify.