All,
First off: very impressive app. This is going to make some of our support needs MUCH easier.
Splunk version: 6.1.1
JMX Monitor App: 204
Just a small configuration question. I have 18 servers that I would like to use this app for. When setting up the "Data Input" in "JMX (Java Management Extensions)" there is a "More settings" checkbox where a "Host field value" can be specified. It defaults to my indexer but I JMX monitor 18 other hosts. Because I'm not collecting JMX values for my indexer, the default dashboard shows blank.
Is there a way to have the host value dynamically set?
The conflicting double "host" values in the results seem to confuse splunk and i cannot search for host=foohost1
Example below where host=foohost1
and host=splunkindexer
:
host=foohost1,jvmDescription="foodescription",mbean_domain="java.lang",mbean_property_type="OperatingSystem",sysLoad="4.75",sysCpuLoad="0.050360606814225314"
host = splunkindexer source = jmx://FOO sourcetype = foo-jmx
Thank you,
Dennis
No problem!
Thank you okrabbe_splunk, your answer was perfect. It lead me to discover that I didn't update the default props.conf stanza that came with the JMX App to use my new sourcetype.
Thanks again!
You can dynamically set the host based on event data.
For example, in your props.conf stanza for the JMX source you would add a reference to a transform.
Then, in transforms.conf you will define that transform -
[jmx_set_host]
REGEX = host=([^,]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
This is described in the docs:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overridedefaulthostassignments