How to set the host of the remote JMX node instead of Splunk indexer?

[denniskline]

All,

First off: very impressive app. This is going to make some of our support needs MUCH easier.

Splunk version: 6.1.1
JMX Monitor App: 204

Just a small configuration question. I have 18 servers that I would like to use this app for. When setting up the "Data Input" in "JMX (Java Management Extensions)" there is a "More settings" checkbox where a "Host field value" can be specified. It defaults to my indexer but I JMX monitor 18 other hosts. Because I'm not collecting JMX values for my indexer, the default dashboard shows blank.

Is there a way to have the host value dynamically set?

The conflicting double "host" values in the results seem to confuse splunk and i cannot search for host=foohost1
Example below where host=foohost1 and host=splunkindexer:

host=foohost1,jvmDescription="foodescription",mbean_domain="java.lang",mbean_property_type="OperatingSystem",sysLoad="4.75",sysCpuLoad="0.050360606814225314"
host = splunkindexer source = jmx://FOO sourcetype = foo-jmx

Thank you,

Dennis

[okrabbe_splunk]

No problem!

[denniskline]

Thank you okrabbe_splunk, your answer was perfect. It lead me to discover that I didn't update the default props.conf stanza that came with the JMX App to use my new sourcetype.

Thanks again!

[okrabbe_splunk]

You can dynamically set the host based on event data.

For example, in your props.conf stanza for the JMX source you would add a reference to a transform.

Then, in transforms.conf you will define that transform -

[jmx_set_host]
REGEX = host=([^,]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

This is described in the docs:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overridedefaulthostassignments