Getting Data In

Adjust collection timing

ksmiley2
Engager

Where is the value declared for collection timing? As far as I can see, the app only collects from the JMX server every 60 seconds. Is there something I have overlooked in the Splunk settings? I would like to adjust the timing to pick up more data. Thanks!

0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

The timing of an input like this is defined in inputs.conf not in the input script itself. The inputs.conf for the Splunk 4 JMX app has this stanza:

[script://./bin/poll_jmx.sh config.xml]
interval = 60
sourcetype = jmx
index = jmx
disabled = 1

Simply change the interval to your liking. You'll note that enabling the input in the first place would have created a new inputs.conf in the local/ subdirectory of the app. You should make your changes to the interval setting in this same local/inputs.conf to ensure that your setting survives an upgrade.

View solution in original post

sowings
Splunk Employee
Splunk Employee

The timing of an input like this is defined in inputs.conf not in the input script itself. The inputs.conf for the Splunk 4 JMX app has this stanza:

[script://./bin/poll_jmx.sh config.xml]
interval = 60
sourcetype = jmx
index = jmx
disabled = 1

Simply change the interval to your liking. You'll note that enabling the input in the first place would have created a new inputs.conf in the local/ subdirectory of the app. You should make your changes to the interval setting in this same local/inputs.conf to ensure that your setting survives an upgrade.

Damien_Dallimor
Ultra Champion

sowings answer is the correct one.

Just to elaborate a bit , you may also wants to consider a JMX polling strategy whereby you have several SPLUNK4JMX config files.These files can be named whatever you like. And then you can setup each of these different configs as seperate scripted inputs on different polling frequencys (as defined in inputs.conf). The reason that you might want to do this is that the outputs of some JMX attributes and operations may change frequently so you want higher polling frequency (every minute) and some outputs might not change that often so you want a lower polling frequency (every hour).

ksmiley2
Engager

Thank you very much for you help! I will do some further exploration of all of these files and their settings/values before my next question...:)

0 Karma

bmacias84
Champion

Within the SPLUNK_HOME/etc/apps/SPLUNK4JMX/bin directory the following control interval poll_jmx and poll_mx4j_jmx. Edit the default vaules.

See INSTALLED COMPONENTS and INSTALLATION SECTIONS.

splunk-for-jmx

0 Karma

ksmiley2
Engager

There are no "default" values to change in poll_jmx.bat so I would assume I have to dig through a jar to find the value...

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...