I am working to normalize the data for Oracle WebLogic which is heavily JMX based so that I can leverage the Application Server module in ITSI.
The Apache Tomcat add-on that is Splunk built gives me 90% of what I need for the WebLogic use case however I am missing the JMX thread info that is returned as separate events using the dumpAllThreads modular input in the Apache Tomcat add-on.
What is required to generalize the dumpAllThreads input for Tomcat so it can be used by another application that has a JMX server?
The Oracle WebLogic application server is similar to Apache Tomcat in data sources (access logs and JMX data) so I used the Apache Tomcat add-on to see what the fields, eventtypes, tags, etc were and have worked to normalize the onboarded data using the JMX add-on and onboarded access logs in order to leverage the Application Server module KPIs, entity discovery and dashboard in ITSI. I also needed to modify some of the dashboard panel saved searches but otherwise am down to a short list of fields I'm still trying to run down for WebLogic that don't directly translate from the generic JMX add-on.
One of the key datasources I still need that is configured as a modular input for the Tomcat add-on is the dumpAllThreads modular input that appears to connect to the JMX server and then dump each thread and state as a separate event. That is currently what I am trying to get in order to continue populating out the Application Server KPIs and dashboard panels in ITSI.
Agreed - I created an internal Splunk JIRA requesting assistance with this. I'm hopeful that whatever was done for the Apache Tomcat add-on to pull in thread info can be generalized for the JMX add-on. I don't know what was required to originally setup that modular input though so working with the "Getting Data In" team appears to be the best option. Thanks all!