All Apps and Add-ons

How to set the host of the remote JMX node instead of Splunk indexer?

New Member


First off: very impressive app. This is going to make some of our support needs MUCH easier.

Splunk version: 6.1.1
JMX Monitor App: 204

Just a small configuration question. I have 18 servers that I would like to use this app for. When setting up the "Data Input" in "JMX (Java Management Extensions)" there is a "More settings" checkbox where a "Host field value" can be specified. It defaults to my indexer but I JMX monitor 18 other hosts. Because I'm not collecting JMX values for my indexer, the default dashboard shows blank.

Is there a way to have the host value dynamically set?

The conflicting double "host" values in the results seem to confuse splunk and i cannot search for host=foohost1
Example below where host=foohost1 and host=splunkindexer:

host = splunkindexer source = jmx://FOO sourcetype = foo-jmx

Thank you,


0 Karma

Splunk Employee
Splunk Employee

No problem!

0 Karma

New Member

Thank you okrabbe_splunk, your answer was perfect. It lead me to discover that I didn't update the default props.conf stanza that came with the JMX App to use my new sourcetype.

Thanks again!

0 Karma

Splunk Employee
Splunk Employee

You can dynamically set the host based on event data.

For example, in your props.conf stanza for the JMX source you would add a reference to a transform.

Then, in transforms.conf you will define that transform -

REGEX = host=([^,]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

This is described in the docs:

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!