Splunk Add-on for Java Management Extensions throws an "Unbound Prefix" error inlog4j.xml and how to fix it

[ethansena]

I ran into a startup error with Splunk_TA_jmx and am including the solution here for others.

After installing the Splunk_TA_jmx app and restarting your Splunk instance, Splunk will throw the following error:

Error while parsing '$SPLUNK_HOME/etc/deployment-apps/Splunk_TA_jmx/bin/lib/log4j.xml':
 unbound prefix: line 4, column 0

Upon investigation, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

Saving and restarting Splunk resolves the issue.

[ethansena · Accepted solution]

Per my answer in the question, the issue is that the log4j.xml file doesn't contain the proper XML namespace prefix (xmlns) value. Using the appropriate value as per Apache (https://logging.apache.org/log4j/2.x/manual/migration.html), line 4 of Splunk_TA_jmx/bin/lib/log4j.xml should be updated to the following:

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

[ppablo]

Hi @ethansena

Thanks for sharing your solution with the community. To make this post more visible, can you actually formally answer your own question by posting the solution in the "Enter your answer here..." box below, and I can accept the answer for you? Otherwise, this post will be floating around showing no answer and people will think it's unresolved. I'll upvote it once you do 🙂 thanks!

Patrick

[ethansena]

Thanks, all done! I had been waiting for my question to be published so I could add/accept the answer.

[ppablo]

No problem, thanks!