All Apps and Add-ons

JMX App: Can you define hostname in the config.xml instead of the

phoenixdigital
Builder

Regarding this app
https://splunkbase.splunk.com/app/668/

CURRENT WORKING CONFIG

We have these config files (redacted of course)

config-myjmx01.xml (partial contents)

<jmxserver jmxServiceURL="service:jmx:remoting-jmx://myjmx01.mydomain.com:9999" jvmDescription="myjmx01 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx">

<mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxxxx.RequestorManagement,id=*">
    <operation name="RequestorList" outputname="RequestorList" />
</mbean>

</jmxserver>

config-myjmx02.xml (partial contents)

<jmxserver jmxServiceURL="service:jmx:remoting-jmx://myjmx02.mydomain.com:9999" jvmDescription="myjmx02 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx">

<mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxx.RequestorManagement,id=*">
    <operation name="RequestorList" outputname="RequestorList" />
</mbean>

</jmxserver>

Then the following inputs.conf

[jmx://myjmx01 system information]
config_file = config-myjmx01.xml
hec_batch_mode = 0
hec_https = 0
host = myjmx01.mydomain.com
index = jmx
output_type = stdout
polling_frequency = 300
sourcetype = theSystem:jmx

[jmx://myjmx01 system information]
config_file = config-myjmx02.xml
hec_batch_mode = 0
hec_https = 0
host = myjmx02.mydomain.com
index = jmx
output_type = stdout
polling_frequency = 300
sourcetype = theSystem:jmx

PREFERRED CONFIG
This all works well. However if we end up with more inputs defined each one starts it's own Java process. They don't use much CPU (~0.4%) or memory (~150 MB) but in the interests of keeping things efficient I was hopeful the host for the data could be pulled from the jmxserver definition even if it was a separate attribute.

We have tested the combined config.xml as you can have multiple jmxserver definitions in it and it works fine. However everything gets marked with the same host value.

combined-config.xml (partial contents)

<jmxserver jmxServiceURL="service:jmx:remoting-jmx://myjmx01.mydomain.com:9999" jvmDescription="myjmx01 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx">

<mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxxxx.RequestorManagement,id=*">
    <operation name="RequestorList" outputname="RequestorList" />
</mbean>

</jmxserver>

<jmxserver jmxServiceURL="service:jmx:remoting-jmx://myjmx02.mydomain.com:9999" jvmDescription="myjmx02 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx">

<mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxx.RequestorManagement,id=*">
    <operation name="RequestorList" outputname="RequestorList" />
</mbean>

</jmxserver>

inputs.conf

[jmx://Combined system information]
config_file = combined-config.xml
hec_batch_mode = 0
hec_https = 0
index = jmx
output_type = stdout
polling_frequency = 300
sourcetype = theSystem:jmx

I am aware I could probably put a props.conf and transforms.conf to extract it from the raw event and convert the host at index time but again that adds to the complexity of the entire configuration for anyone in the future who might want to add more jmxserver configurations.

I'm trying to keep the whole process as easy as possible so that future users who are less Splunk savvy will be able to quickly and easily add more jmx servers but just editting the one xml config file.

So basically after all of that is it possible to define the host that the input will use in the jmxserver definition allowing for less java processes running on the collection endpoint?

0 Karma

phoenixdigital
Builder

Edit: Actually this did not work. My original question still stands.


Disregard I RTFM!!!!

I can define a host in the jmxserver definition and it doesn't impact anything but returns the correct host.

inputs.conf

 [jmx://Combined system information]
 config_file = config-combined.xml
 hec_batch_mode = 0
 hec_https = 0
 index = jmx
 output_type = stdout
 polling_frequency = 300
 sourcetype = theSystem:jmx

config-combined.xml

 <jmxserver host="myjmx01" jmxServiceURL="service:jmx:remoting-jmx://myjmx01.mydomain.com:9999" jvmDescription="myjmx01 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx">

 <mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxxxx.RequestorManagement,id=*">
     <operation name="RequestorList" outputname="RequestorList" />
 </mbean>

 </jmxserver>
 <jmxserver host="myjmx02" jmxServiceURL="service:jmx:remoting-jmx://myjmx02.mydomain.com:9999" jvmDescription="myjmx02 JMX Data" jmxuser="SplunkAccessUser" jmxpass="xxxxxxxxxxxxx">

 <mbean domain="com.xxxxxxxx" properties="type=web,name=com.xxxxxx.RequestorManagement,id=*">
     <operation name="RequestorList" outputname="RequestorList" />
 </mbean>

 </jmxserver>
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...