Install ed JMX 2.0 on Splunk 6.0
Used the JMX modular input to enter new JMX connections into the input.conf. I have also created a stimple configuration for each connection.
Example:
<!-- Connect to a JVM via the remote JMX interface -->
After the setup I can do a search with index=jmx host=xxxxxxx and can see the JMX data coming. When I use the JMX metrics I am unable to see my hosts or JVM descriptions as I have set them up.
ideas?
Your sourcetype has to be "jmx" for the example dashboards that ship with the app to populate.
If you want to use a different sourcetype such as "jetty" , you'll have to update the sourcetype in the searches in the Simple XML views.
It's a very quick refactor , should take you no more than a couple of minutes.
Change the sourcetype in these files :
./default/data/ui/views/jvm_operatingsystem.xml
./default/data/ui/views/jvm_memorypools.xml
./default/data/ui/views/jvm_threading.xml
./default/data/ui/views/jvm_compilation.xml
./default/data/ui/views/jvm_memory.xml
./default/data/ui/views/jvm_runtime.xml
./default/data/ui/views/jvm_classloading.xml
./default/data/ui/views/jvm_garbagecollection.xml
Your sourcetype has to be "jmx" for the example dashboards that ship with the app to populate.
If you want to use a different sourcetype such as "jetty" , you'll have to update the sourcetype in the searches in the Simple XML views.
It's a very quick refactor , should take you no more than a couple of minutes.
Change the sourcetype in these files :
./default/data/ui/views/jvm_operatingsystem.xml
./default/data/ui/views/jvm_memorypools.xml
./default/data/ui/views/jvm_threading.xml
./default/data/ui/views/jvm_compilation.xml
./default/data/ui/views/jvm_memory.xml
./default/data/ui/views/jvm_runtime.xml
./default/data/ui/views/jvm_classloading.xml
./default/data/ui/views/jvm_garbagecollection.xml
[jmx://jetty_server]
config_file = jetty_server.xml
host = server
index = jmx
polling_frequency = 60
sourcetype = jetty
for the example provided the index=jmx and sourcetype=jetty
When you say you cant see your host or jvmDescription values , do you mean in the dropdown fields on the form views under the JVM Metrics Menu item ?
what is your index and sourcetype ?
Connection event:
host=xxxxxxxx,jvmDescription="mcuws",mbean_domain="com.hazelcast",mbean_property_Cluster="xxxx",mbean_property_name="Local",mbean_property_type="Member",Port="7390",InetAddress="/xx.xxx.xx.xx",LiteMember="false"
host=xxxxxxxx,jvmDescription="mcuws",mbean_domain="com.hazelcast",mbean_property_name="xxxx",mbean_property_type="Cluster",Config="Config{groupConfig=GroupConfig [name=NVT, password=***********], liteMember=false, checkCompatibility=true, properties={hazelcast.mancenter.enabled=false, hazelcast.socket.no.delay=true, hazelcast.executor.client.thread.count
I can't replicate this issue. Can you post an example of the raw event that is indexed.