index Java thread dumps using jstack

[avishayh]

I am trying to index a "jstack" output in splunk of my jboss server.

the output looks like this:

2012-07-03 17:46:49
Full thread dump Java HotSpot(TM) 64-Bit Server VM (14.0-b16 mixed mode):

"Transport1" daemon prio=3 tid=0x0000000009290000 nid=0x1493f runnable [0xfffffd7e83ebe000]
java.lang.Thread.State: RUNNABLE
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.read(SocketInputStream.java:129)
at jcifs.util.transport.Transport.readn(Transport.java:29)
at jcifs.smb.SmbTransport.peekKey(SmbTransport.java:366)
at jcifs.util.transport.Transport.loop(Transport.java:96)
at jcifs.util.transport.Transport.run(Transport.java:258)
at java.lang.Thread.run(Thread.java:619)

"WorkManager(2)-6248" daemon prio=3 tid=0x0000000008f2f000 nid=0x1493e in Object.wait() [0xfffffd7e837b7000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"JMSThread(3)-6246" daemon prio=3 tid=0x0000000006ff0800 nid=0x1493d in Object.wait() [0xfffffd7e83aba000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7eea50cd80> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"Attach Listener" daemon prio=3 tid=0x0000000007b28000 nid=0x14932 waiting on condition [0x0000000000000000]
java.lang.Thread.State: RUNNABLE

"WorkManager(2)-6247" daemon prio=3 tid=0x0000000002350000 nid=0x14931 in Object.wait() [0xfffffd7e89680000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

... and so on ...

anyone had experience with thread dumps content in splunk.

Splunk is not parsing this log very well by default, i am looking for someone who already index java thread dumps and can pass some knowledge + configurations for that

Tks

[avishayh · Accepted solution]

found the answer in here:
http://splunk-base.splunk.com/answers/52135/propsconf-regexp-help