All Apps and Add-ons

Can i get JMX to connect Dynamically to a URL



I have a process the can produce multiple JMX address on the server side.

LAUNCHERHIBERNATE - service:jmx:rmi://
LAUNCHER_WAREHOUSE - service:jmx:rmi://

I can get Splunk to read this file, but i now need it to update JMX dynamically as the URL will change each time. Is this possible. I know i can do it static, but not sure i can do it dynamically?

So if i can connect to JMX via search(SPL) this should work - so is it possible to do that?

Cheers in Advance

0 Karma


As I understand your issue:
Splunk is indexing events as your process creates JMX addresses.

You want to be able to use call a custom command which will run a query against the JMX address in the event.

I would address this issue by creating a search command:

The command you create can then be used at search time, and can take arguments based on the field in the events, which will then be run through the command.

0 Karma



Thanks for the answer.
So i am trying to understand this.

Normally the JMX would need a lot of information to pull JMX data down, this is stored in files in the JMX app.

for example /dell425srv2/apps/splunk_old_versions/splunk_7_0_3/splunk/etc/apps/Splunk_TA_jmx/local

description = MUREX
disabled = 0
index = jmx
interval = 20
servers = Splunk_TA_jmx:TEST2 | Splunk_TA_jmx:TRADE_INSERTION
sourcetype = jmx
templates = Splunk_TA_jmx:MUREX

This would also need jmx_servers.conf
description = TEST2
has_account = 1
interval = 60
jmx_url = service:jmx:rmi://mx12673vm:9092/jndi/rmi://mx12673vm:9092/jmxrmi

description = TRADE_INSERTION
has_account = 1
interval = 5
jmx_url = service:jmx:rmi://hp656srv:26827/jndi/rmi://hp656srv:26827/jmxrmi

What i need is to add multiple jmx_url onto the jmx_server.conf and create an increased line in servers = Splunk_TA_jmx:TEST2 | Splunk_TA_jmx:TRADE_INSERTION + X + Y etc...

What i am not really getting is how this custom search command would work?
What would the workflow be in this case? Would it change these files or would it be something different pure command line that i could run and it would do what above is doing but on the fly?

Thanks in advance
Robert Lynch

0 Karma


You asked: So if i can connect to JMX via search(SPL) this should work - so is it possible to do that?

A custom command would enable you to connect to each JMX via SPL, at search time. I had inferred you were already indexing the logged events with the JMX urls.

However, it appears you are talking about dynamically updating configurations files in the TA?

Is there a RestAPI endpoint for the stanza you are trying to edit? You could try scripting it to change via Rest.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...