All Apps and Add-ons

How to set the host of the remote JMX node instead of Splunk indexer?

denniskline
New Member

All,

First off: very impressive app. This is going to make some of our support needs MUCH easier.

Splunk version: 6.1.1
JMX Monitor App: 204

Just a small configuration question. I have 18 servers that I would like to use this app for. When setting up the "Data Input" in "JMX (Java Management Extensions)" there is a "More settings" checkbox where a "Host field value" can be specified. It defaults to my indexer but I JMX monitor 18 other hosts. Because I'm not collecting JMX values for my indexer, the default dashboard shows blank.

Is there a way to have the host value dynamically set?

The conflicting double "host" values in the results seem to confuse splunk and i cannot search for host=foohost1
Example below where host=foohost1 and host=splunkindexer:

host=foohost1,jvmDescription="foodescription",mbean_domain="java.lang",mbean_property_type="OperatingSystem",sysLoad="4.75",sysCpuLoad="0.050360606814225314"
host = splunkindexer source = jmx://FOO sourcetype = foo-jmx

Thank you,

Dennis

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

No problem!

0 Karma

denniskline
New Member

Thank you okrabbe_splunk, your answer was perfect. It lead me to discover that I didn't update the default props.conf stanza that came with the JMX App to use my new sourcetype.

Thanks again!

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

You can dynamically set the host based on event data.

For example, in your props.conf stanza for the JMX source you would add a reference to a transform.

Then, in transforms.conf you will define that transform -

[jmx_set_host]
REGEX = host=([^,]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

This is described in the docs:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overridedefaulthostassignments

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...