All Apps and Add-ons

Splunk Add-on for Java Management Extensions throws an "Unbound Prefix" error inlog4j.xml and how to fix it

ethansena
Explorer

I ran into a startup error with Splunk_TA_jmx and am including the solution here for others.

After installing the Splunk_TA_jmx app and restarting your Splunk instance, Splunk will throw the following error:

Error while parsing '$SPLUNK_HOME/etc/deployment-apps/Splunk_TA_jmx/bin/lib/log4j.xml':
 unbound prefix: line 4, column 0

Upon investigation, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

Saving and restarting Splunk resolves the issue.

0 Karma
1 Solution

ethansena
Explorer

Per my answer in the question, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of Splunk_TA_jmx/bin/lib/log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

View solution in original post

ethansena
Explorer

Per my answer in the question, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of Splunk_TA_jmx/bin/lib/log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

ppablo
Retired

Hi @ethansena

Thanks for sharing your solution with the community. To make this post more visible, can you actually formally answer your own question by posting the solution in the "Enter your answer here..." box below, and I can accept the answer for you? Otherwise, this post will be floating around showing no answer and people will think it's unresolved. I'll upvote it once you do 🙂 thanks!

Patrick

0 Karma

ethansena
Explorer

Thanks, all done! I had been waiting for my question to be published so I could add/accept the answer.

0 Karma

ppablo
Retired

No problem, thanks!

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...