How to monitor a file within a VM?

[cmccoy]

How do you configure Splunk to monitor files within a VM? I installed Splunk within a VM and added a data input to monitor the file changes to a series of files. When I view the data input on the Files and Directories page it does show that it is monitoring a number of files but nothing is ever indexed. Is there a different procedure to monitor files that are within a VM?

[jrodman]

There is nothing particular about VMs here. Splunk needs to be running in an environment where it can access the log files by the path that you specify.

[gkanapathy]

Should be the same. Is it possible you don't have enough space on the VM data volume so that indexing pauses?

[mayler]

So when you go into Search, Status, Inputs...you see data. But when you go into Search, Status, Index Activity...you don't see anything?

I created a File/Directory input as well. Do you have a whitelist or blacklist configured?