All Apps and Add-ons

JMX_TA 2.0

jberlin
Path Finder

Install ed JMX 2.0 on Splunk 6.0

Used the JMX modular input to enter new JMX connections into the input.conf. I have also created a stimple configuration for each connection.

Example:


<!-- Connect to a JVM via the remote JMX interface -->



After the setup I can do a search with index=jmx host=xxxxxxx and can see the JMX data coming. When I use the JMX metrics I am unable to see my hosts or JVM descriptions as I have set them up.

ideas?

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Your sourcetype has to be "jmx" for the example dashboards that ship with the app to populate.
If you want to use a different sourcetype such as "jetty" , you'll have to update the sourcetype in the searches in the Simple XML views.

It's a very quick refactor , should take you no more than a couple of minutes.
Change the sourcetype in these files :

./default/data/ui/views/jvm_operatingsystem.xml
./default/data/ui/views/jvm_memorypools.xml
./default/data/ui/views/jvm_threading.xml
./default/data/ui/views/jvm_compilation.xml
./default/data/ui/views/jvm_memory.xml
./default/data/ui/views/jvm_runtime.xml
./default/data/ui/views/jvm_classloading.xml
./default/data/ui/views/jvm_garbagecollection.xml

View solution in original post

Damien_Dallimor
Ultra Champion

Your sourcetype has to be "jmx" for the example dashboards that ship with the app to populate.
If you want to use a different sourcetype such as "jetty" , you'll have to update the sourcetype in the searches in the Simple XML views.

It's a very quick refactor , should take you no more than a couple of minutes.
Change the sourcetype in these files :

./default/data/ui/views/jvm_operatingsystem.xml
./default/data/ui/views/jvm_memorypools.xml
./default/data/ui/views/jvm_threading.xml
./default/data/ui/views/jvm_compilation.xml
./default/data/ui/views/jvm_memory.xml
./default/data/ui/views/jvm_runtime.xml
./default/data/ui/views/jvm_classloading.xml
./default/data/ui/views/jvm_garbagecollection.xml

jberlin
Path Finder

[jmx://jetty_server]
config_file = jetty_server.xml
host = server
index = jmx
polling_frequency = 60
sourcetype = jetty

0 Karma

jberlin
Path Finder

for the example provided the index=jmx and sourcetype=jetty

0 Karma

Damien_Dallimor
Ultra Champion

When you say you cant see your host or jvmDescription values , do you mean in the dropdown fields on the form views under the JVM Metrics Menu item ?

what is your index and sourcetype ?

0 Karma

jberlin
Path Finder

Connection event:
host=xxxxxxxx,jvmDescription="mcuws",mbean_domain="com.hazelcast",mbean_property_Cluster="xxxx",mbean_property_name="Local",mbean_property_type="Member",Port="7390",InetAddress="/xx.xxx.xx.xx",LiteMember="false"

host=xxxxxxxx,jvmDescription="mcuws",mbean_domain="com.hazelcast",mbean_property_name="xxxx",mbean_property_type="Cluster",Config="Config{groupConfig=GroupConfig [name=NVT, password=***********], liteMember=false, checkCompatibility=true, properties={hazelcast.mancenter.enabled=false, hazelcast.socket.no.delay=true, hazelcast.executor.client.thread.count

0 Karma

Damien_Dallimor
Ultra Champion

I can't replicate this issue. Can you post an example of the raw event that is indexed.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...