Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About alex3
alex3
Path Finder
Member since:
12-22-2021
06-15-2022
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-22-2021 |
Activity Feed
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-26-2022 06:01 AM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-25-2022 12:36 PM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-25-2022 07:22 AM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-24-2022 12:16 PM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-24-2022 09:20 AM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-24-2022 08:59 AM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-24-2022 08:49 AM
- Posted Re: Received event for unconfigured/disabled/deleted index on Getting Data In. 05-24-2022 07:18 AM
- Posted Splunk Add-on for Java Management Extensions: Why the error "Received event for unconfigured/disabled/deleted index"? on Getting Data In. 05-24-2022 06:05 AM
- Posted Re: Splunk add-on for JMX: Failed to retrieve RMIServer stub on All Apps and Add-ons. 12-22-2021 10:23 AM
- Posted Splunk add-on for JMX: Failed to retrieve RMIServer stub on All Apps and Add-ons. 12-22-2021 09:09 AM
- Tagged Splunk add-on for JMX: Failed to retrieve RMIServer stub on All Apps and Add-ons. 12-22-2021 09:09 AM
- Tagged Splunk add-on for JMX: Failed to retrieve RMIServer stub on All Apps and Add-ons. 12-22-2021 09:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-26-2022
06:01 AM
It does show the index as enabled on the indexers. I found these logs in the search head splunkd.log: 05-26-2022 12:54:26.980 +0000 WARN DateParserVerbose [30526 merging] - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Thu May 26 12:54:24 2022). Context: source=/opt/apps/splunk/var/log/splunk/jmx.log|host=[removed]|jmx-too_small|144797 05-20-2022 16:34:20.408 +0000 INFO SpecFiles - Found external scheme definition for stanza="ibm_was_jmx://" from spec file="/opt/apps/splunk/etc/apps/Splunk_TA_jmx/README/inputs.conf.spec" with parameters="config_file, config_file_dir" 05-23-2022 21:52:22.077 +0000 WARN IndexerService [30474 indexerPipe] - Received event for unconfigured/disabled/deleted index=jmx with source="source::com.sun.messaging.jms.server:type=Connection,subtype=Config,id=2333287862699082496" host="host::[removed]:0" sourcetype="sourcetype::jmx". So far received events from 1 missing index(es).
... View more
05-25-2022
12:36 PM
I ran the following command on one of my indexer nodes. ./splunk btool indexes list And I do see my index there: [jmx] archiver.enableDataArchive = false archiver.maxDataArchiveRetentionPeriod = 0 assureUTF8 = false bucketMerge.maxMergeSizeMB = 1000 bucketMerge.maxMergeTimeSpanSecs = 7776000 bucketMerge.minMergeSizeMB = 750 bucketMerging = false bucketRebuildMemoryHint = auto coldPath = /opt/splunk-data/cold/jmx/colddb coldPath.maxDataSizeMB = 0 coldToFrozenDir = coldToFrozenScript = compressRawdata = true datatype = event defaultDatabase = main enableDataIntegrityControl = true enableOnlineBucketRepair = true enableRealtimeSearch = true enableTsidxReduction = false federated.dataset = federated.provider = fileSystemExecutorWorkers = 5 frozenTimePeriodInSecs = 31536000 homePath = /opt/splunk-data/home/jmx/db homePath.maxDataSizeMB = 650000 hotBucketStreaming.deleteHotsAfterRestart = false hotBucketStreaming.extraBucketBuildingCmdlineArgs = hotBucketStreaming.removeRemoteSlicesOnRoll = false hotBucketStreaming.reportStatus = false hotBucketStreaming.sendSlices = false hotBucketTimeRefreshInterval = 10 indexThreads = auto journalCompression = gzip maxBloomBackfillBucketAge = 30d maxBucketSizeCacheEntries = 0 maxConcurrentOptimizes = 6 maxDataSize = 1024 maxGlobalDataSizeMB = 0 maxGlobalRawDataSizeMB = 0 maxHotBuckets = auto maxHotIdleSecs = 0 maxHotSpanSecs = 7776000 maxMemMB = 5 maxMetaEntries = 1000000 maxRunningProcessGroups = 8 maxRunningProcessGroupsLowPriority = 1 maxTimeUnreplicatedNoAcks = 300 maxTimeUnreplicatedWithAcks = 60 maxTotalDataSizeMB = 5000 maxWarmDBCount = 300 memPoolMB = auto metric.compressionBlockSize = 1024 metric.enableFloatingPointCompression = true metric.maxHotBuckets = auto metric.splitByIndexKeys = metric.stubOutRawdataJournal = true metric.timestampResolution = s metric.tsidxTargetSizeMB = 1500 minHotIdleSecsBeforeForceRoll = auto minRawFileSyncSecs = disable minStreamGroupQueueSize = 2000 partialServiceMetaPeriod = 0 processTrackerServiceInterval = 1 quarantineFutureSecs = 2592000 quarantinePastSecs = 77760000 rawChunkSizeBytes = 131072 repFactor = auto rotatePeriodInSecs = 60 rtRouterQueueSize = 10000 rtRouterThreads = 0 selfStorageThreads = 2 serviceInactiveIndexesPeriod = 60 serviceMetaPeriod = 25 serviceOnlyAsNeeded = true serviceSubtaskTimingPeriod = 30 splitByIndexKeys = streamingTargetTsidxSyncPeriodMsec = 5000 suppressBannerList = suspendHotRollByDeleteQuery = false sync = 0 syncMeta = true thawedPath = /opt/splunk-data/cold/jmx/thaweddb throttleCheckPeriod = 15 timePeriodInSecBeforeTsidxReduction = 604800 tsidxDedupPostingsListMaxTermsLimit = 8388608 tsidxReductionCheckPeriodInSec = 600 tsidxTargetSizeMB = 1500 tsidxWritingLevel = 2 tstatsHomePath = volume:_splunk_summaries/$_index_name/datamodel_summary waitPeriodInSecsForManifestWrite = 60 warmToColdScript =
... View more
05-25-2022
07:22 AM
Yes, we have two indexer nodes and four search head nodes and I restarted all of them, but I still got the same message.
... View more
05-24-2022
12:16 PM
I restarted the index and search head clusters and I am still having the same issue.
... View more
05-24-2022
09:20 AM
I was able to find splunk/etc/slave-apps/_cluster/local/indexes.conf and it does have my index, jmx, on both indexer nodes so it does appear to have replicated correctly on the indexers.
... View more
05-24-2022
08:59 AM
None of my nodes have a etc/apps/slave-apps directory, including my test environment where it is working.
... View more
05-24-2022
08:49 AM
Sorry Giuseppe, I was unclear. This is the process that I used to create the index before I made this post. I thought that this should work but it is not working correctly.
... View more
05-24-2022
07:18 AM
Thank you for your suggestion gcusello! I created the index by adding it to /opt/apps/splunk/etc/master-apps/_cluster/local/indexes.conf on the management node. Then, I went to the web-ui of the management node, Settings > Distributed Environment > Indexer Clustering > Edit > Configuration Bundle Actions. I clicked Validate and Check Restart, then Push. Everything appeared to run successfully.
... View more
05-24-2022
06:05 AM
Hello,
We recently installed the Splunk Add-on for Java Management Extensions. We have it working in our test environment but not production. We get this error message:
Received event for unconfigured/disabled/deleted index=jmx with source="source::com.sun.messaging.jms.server:type=Connection,subtype=Config,id=2333287862699082496" host="host::[removed]:0" sourcetype="sourcetype::jmx". So far received events from 1 missing index(es)
We have a distributed deployment. The index has been created on the indexers. When I login to the Indexers and go to Settings > Data > Indexes, I can see the 'jmx' index. However, if I login to the Management node and go to Settings > Distributed Environment > Indexer Clustering, the 'jmx' index isn't there.
As far as I can tell, I've configured Test and Prod identically, so I'm not sure what the issue is. Does anyone have any ideas of what I can check?
... View more
Labels
- Labels:
-
index
12-22-2021
10:23 AM
We resolved the issue. We needed to specify jmxuser and jmxpass, NOT account_name and account_password in the jmx_servers.conf file. After changing that and a restart of Splunk, it started working.
... View more
12-22-2021
09:09 AM
Hello Splunk Community! My team and I have been stuck trying to get the Splunk add-on for JMX working for us. We've installed the add-on to a heavy forwarder and are trying to connect to the local JMX server URL. After doing so, we get the following in our jmx.log: 2021-12-22 17:03:19,883 - com.splunk.modinput.ModularInput -5318 [Thread-2] INFO [] - Failed connection with service:jmx:rmi://hostname/jndi/rmi://hostname:8578/hostname/8577/jmxrmi, connecting with service:jmx:rmi://hostname/jndi/JMXConnector . 2021-12-22 17:03:19,884 - com.splunk.modinput.ModularInput -5319 [Thread-2] ERROR [] - Exception@checkConnector, e= java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.NoInitialContextException: Need to specify class name in environment or system property, or as an applet parameter, or in an application resource file: java.naming.factory.initial at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:369) ~[?:1.8.0_275] at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:270) ~[?:1.8.0_275] at javax.management.remote.JMXConnectorFactory.connect(JMXConnectorFactory.java:229) ~[?:1.8.0_275] at com.splunk.jmx.ServerTask.connect(Unknown Source) ~[jmxmodinput.jar:?] at com.splunk.jmx.ServerTask.checkConnector(Unknown Source) [jmxmodinput.jar:?] at com.splunk.jmx.Scheduler.run(Unknown Source) [jmxmodinput.jar:?] Caused by: javax.naming.NoInitialContextException: Need to specify class name in environment or system property, or as an applet parameter, or in an application resource file: java.naming.factory.initial at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:662) ~[?:1.8.0_275] at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:313) ~[?:1.8.0_275] at javax.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:350) ~[?:1.8.0_275] at javax.naming.InitialContext.lookup(InitialContext.java:417) ~[?:1.8.0_275] at javax.management.remote.rmi.RMIConnector.findRMIServerJNDI(RMIConnector.java:1955) ~[?:1.8.0_275] at javax.management.remote.rmi.RMIConnector.findRMIServer(RMIConnector.java:1922) ~[?:1.8.0_275] at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:287) ~[?:1.8.0_275] ... 5 more Our jmx_servers.conf file is configured as follows: [default] [jms4] account_name = username destinationapp = Splunk_TA_jmx jmx_url = service:jmx:rmi://hostname/jndi/rmi://hostname:8578/hostname/8577/jmxrmi protocol = url account_password = password We confirmed that the URL works, because we were able to reach it with the following code: class Scratch {
public static void main(String[] args) throws Exception {
final JMXServiceURL jmxUrl = new JMXServiceURL("service:jmx:rmi://hostname/jndi/rmi://hostname:9878/hostname/9877/jmxrmi");
final Map<String, String[]> props = new HashMap<>();
props.put("jmx.remote.credentials", new String[]{"username", "password"});
final JMXConnector jmxConnector = JMXConnectorFactory.connect(jmxUrl, props);
final MBeanServerConnection mbsc = jmxConnector.getMBeanServerConnection();
Arrays.asList(mbsc.getDomains()).forEach(System.out::println);
} Any assistance is appreciated.
... View more
Labels
- Labels:
-
configuration
-
troubleshooting
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-15-2022
02:04 PM
|
