All Apps and Add-ons

Problem configuring Splunk Add-on for JMX

tsomod
Path Finder

Hi,

I am currently having a problem receiving data through the Splunk Add-on for JMX. I have followed the troubleshooting guides with no luck and can find no errors in the configuration files. I have a similar working installation on another heavy forwarder which is working just fine. I have also verified that the JMX-links can be contacted locally and that the servers/ports can be reached from the heavy forwarder which has the TA installed. There are also no blocks in the firewall. Additionally, I have verified that a supported version of the Java JDK is installed and that the environment paths point to this version of Java. My only lead is this error message that is being spammed in the jmx.log:

2018-10-31 10:25:31,994 - com.splunk.modinput.ModularInput -0    [main] ERROR  - Error executing modular input : null : java.lang.NullPointerException
    at com.splunk.jmx.InfoManager.isJMXAccount(Unknown Source)
    at com.splunk.jmx.InfoManager.getAccounts(Unknown Source)
    at com.splunk.jmx.JMXModularInputV3.doRun(Unknown Source)
    at com.splunk.modinput.ModularInput.init(Unknown Source)
    at com.splunk.jmx.JMXModularInputV3.main(Unknown Source)

However, when I removed and reinstalled the TA the same error was shown in the log, even though I had configured no inputs. This makes me believe that there is no problem with the inputs, but rather with the TA itself. So, what I'm wondering is whether any of you have encountered a similar problem, and if you found a solution to it. I hope you can help me.

Tags (2)

josh12121984
Engager

I am currently having a problem receiving data through the Splunk Add-on for JMX. I have followed the troubleshooting guides with no luck and can find no errors in the configuration files. I have also verified that the JMX-links can be contacted locally and that the servers/ports can be reached from the heavy forwarder which has the TA installed. There are also no blocks in the firewall. Additionally, I have verified that a supported version of the Java JDK is installed and that the environment paths point to this version of Java.

We engaged Splunk support and on-demand engineers to look into this issue and no luck.  not able to find any errors in the log file.

0 Karma

timothywatson
Path Finder

Did you resolve this issue? Are (were) there any differences in the Java versions, OS versions, etc. between the working/non-working envs? I have an identical error, let me know if I can help you to isolate the issue...

0 Karma

tsomod
Path Finder

Hi,
Unfortunatley I never found out what was causing these errors. The TA was formerly running on RHEL6. I rebuilt Splunk + the TA on a new server that is RHEL7 and voila, the problems disappeared.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...