Splunk Dev

index Java thread dumps using jstack

avishayh
Explorer

I am trying to index a "jstack" output in splunk of my jboss server.

the output looks like this:

2012-07-03 17:46:49
Full thread dump Java HotSpot(TM) 64-Bit Server VM (14.0-b16 mixed mode):

"Transport1" daemon prio=3 tid=0x0000000009290000 nid=0x1493f runnable [0xfffffd7e83ebe000]
java.lang.Thread.State: RUNNABLE
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.read(SocketInputStream.java:129)
at jcifs.util.transport.Transport.readn(Transport.java:29)
at jcifs.smb.SmbTransport.peekKey(SmbTransport.java:366)
at jcifs.util.transport.Transport.loop(Transport.java:96)
at jcifs.util.transport.Transport.run(Transport.java:258)
at java.lang.Thread.run(Thread.java:619)

"WorkManager(2)-6248" daemon prio=3 tid=0x0000000008f2f000 nid=0x1493e in Object.wait() [0xfffffd7e837b7000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"JMSThread(3)-6246" daemon prio=3 tid=0x0000000006ff0800 nid=0x1493d in Object.wait() [0xfffffd7e83aba000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7eea50cd80> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"Attach Listener" daemon prio=3 tid=0x0000000007b28000 nid=0x14932 waiting on condition [0x0000000000000000]
java.lang.Thread.State: RUNNABLE

"WorkManager(2)-6247" daemon prio=3 tid=0x0000000002350000 nid=0x14931 in Object.wait() [0xfffffd7e89680000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

... and so on ...

anyone had experience with thread dumps content in splunk.

Splunk is not parsing this log very well by default, i am looking for someone who already index java thread dumps and can pass some knowledge + configurations for that

Tks

0 Karma
1 Solution

avishayh
Explorer
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...