All Apps and Add-ons

Splunk Add-on for Java Management Extensions throws an "Unbound Prefix" error inlog4j.xml and how to fix it

ethansena
Explorer

I ran into a startup error with Splunk_TA_jmx and am including the solution here for others.

After installing the Splunk_TA_jmx app and restarting your Splunk instance, Splunk will throw the following error:

Error while parsing '$SPLUNK_HOME/etc/deployment-apps/Splunk_TA_jmx/bin/lib/log4j.xml':
 unbound prefix: line 4, column 0

Upon investigation, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

Saving and restarting Splunk resolves the issue.

0 Karma
1 Solution

ethansena
Explorer

Per my answer in the question, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of Splunk_TA_jmx/bin/lib/log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

View solution in original post

ethansena
Explorer

Per my answer in the question, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of Splunk_TA_jmx/bin/lib/log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

ppablo
Retired

Hi @ethansena

Thanks for sharing your solution with the community. To make this post more visible, can you actually formally answer your own question by posting the solution in the "Enter your answer here..." box below, and I can accept the answer for you? Otherwise, this post will be floating around showing no answer and people will think it's unresolved. I'll upvote it once you do 🙂 thanks!

Patrick

0 Karma

ethansena
Explorer

Thanks, all done! I had been waiting for my question to be published so I could add/accept the answer.

0 Karma

ppablo
Retired

No problem, thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...