Can i get JMX to connect Dynamically to a URL

[robertlynch2020]

Hi

I have a process the can produce multiple JMX address on the server side.

LAUNCHERHIBERNATE - service:jmx:rmi://hp656srv.fr.murex.com:58884/jndi/rmi://hp656srv.fr.murex.com:58884/jmxrmi
LAUNCHER_WAREHOUSE - service:jmx:rmi://hp656srv.fr.murex.com:46153/jndi/rmi://hp656srv.fr.murex.com:46153/jmxrmi
etc....

I can get Splunk to read this file, but i now need it to update JMX dynamically as the URL will change each time. Is this possible. I know i can do it static, but not sure i can do it dynamically?

So if i can connect to JMX via search(SPL) this should work - so is it possible to do that?

Cheers in Advance
Robert

[solarboyz1]

As I understand your issue:
Splunk is indexing events as your process creates JMX addresses.

You want to be able to use call a custom command which will run a query against the JMX address in the event.

I would address this issue by creating a search command: http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

The command you create can then be used at search time, and can take arguments based on the field in the events, which will then be run through the command.

[robertlynch2020]

Hi

Thanks for the answer.
So i am trying to understand this.

Normally the JMX would need a lot of information to pull JMX data down, this is stored in files in the JMX app.

for example /dell425srv2/apps/splunk_old_versions/splunk_7_0_3/splunk/etc/apps/Splunk_TA_jmx/local

jmx_tasks.conf
[MUREX]
description = MUREX
disabled = 0
index = jmx
interval = 20
servers = Splunk_TA_jmx:TEST2 | Splunk_TA_jmx:TRADE_INSERTION
sourcetype = jmx
templates = Splunk_TA_jmx:MUREX

This would also need jmx_servers.conf
[TEST2]
description = TEST2
has_account = 1
interval = 60
jmx_url = service:jmx:rmi://mx12673vm:9092/jndi/rmi://mx12673vm:9092/jmxrmi

[TRADE_INSERTION]
description = TRADE_INSERTION
has_account = 1
interval = 5
jmx_url = service:jmx:rmi://hp656srv:26827/jndi/rmi://hp656srv:26827/jmxrmi

What i need is to add multiple jmx_url onto the jmx_server.conf and create an increased line in servers = Splunk_TA_jmx:TEST2 | Splunk_TA_jmx:TRADE_INSERTION + X + Y etc...

What i am not really getting is how this custom search command would work?
What would the workflow be in this case? Would it change these files or would it be something different pure command line that i could run and it would do what above is doing but on the fly?

Thanks in advance
Robert Lynch

[solarboyz1]

You asked: So if i can connect to JMX via search(SPL) this should work - so is it possible to do that?

A custom command would enable you to connect to each JMX via SPL, at search time. I had inferred you were already indexing the logged events with the JMX urls.

However, it appears you are talking about dynamically updating configurations files in the TA?

Is there a RestAPI endpoint for the stanza you are trying to edit? You could try scripting it to change via Rest.