Found this link as well, with an answer http://answers.splunk.com/answers/203218/errors-on-jmx-ta-using-splunk-universal-forwarders.html ... View more

Answer here http://answers.splunk.com/answers/203218/errors-on-jmx-ta-using-splunk-universal-forwarders.html ... View more

redcorjo > The tool complains in the UF about missing directory ${SPLUNK_HOME}/apps/jmx_ta/bin/lib/boot. I workaround it by creating by hand. Is it normal I need to do it by hand or I miss anything? A fix for this is to create a file on the deployment server ${SPLUNK_HOME}/apps/jmx_ta/bin/lib/boot/ignore Then edit jmx.py change def build_classpath(rootdir,sep): classpath = "" for filename in os.listdir(rootdir): classpath = classpath + rootdir+filename+sep return classpath to def build_classpath(rootdir,sep): classpath = "" for filename in os.listdir(rootdir): if filename != "ignore": classpath = classpath + rootdir+filename+sep return classpath This then allows the deployment server to push out the directory that is needed as it is non blank. Then the jmx.py will not complain that the directory can not be found. ... View more

Needed Python 2.7, but did not want to install it on the OS so used this to use the forwarder to have python installed local http://answers.splunk.com/answers/203218/errors-on-jmx-ta-using-splunk-universal-forwarders.html ... View more

If you're dispatching directly through Python, there should be no limits, however there may be hidden limits depending on the search terms used. Have a look at your search query string and see if it contains any terms which may contain any limits - for example is you pipe to sort this will be default be limited to 10000 rows regardless of how the search is run (the behaviour can then be changed within the query). ... View more