Splunk Dev

index Java thread dumps using jstack

avishayh
Explorer

I am trying to index a "jstack" output in splunk of my jboss server.

the output looks like this:

2012-07-03 17:46:49
Full thread dump Java HotSpot(TM) 64-Bit Server VM (14.0-b16 mixed mode):

"Transport1" daemon prio=3 tid=0x0000000009290000 nid=0x1493f runnable [0xfffffd7e83ebe000]
java.lang.Thread.State: RUNNABLE
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.read(SocketInputStream.java:129)
at jcifs.util.transport.Transport.readn(Transport.java:29)
at jcifs.smb.SmbTransport.peekKey(SmbTransport.java:366)
at jcifs.util.transport.Transport.loop(Transport.java:96)
at jcifs.util.transport.Transport.run(Transport.java:258)
at java.lang.Thread.run(Thread.java:619)

"WorkManager(2)-6248" daemon prio=3 tid=0x0000000008f2f000 nid=0x1493e in Object.wait() [0xfffffd7e837b7000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"JMSThread(3)-6246" daemon prio=3 tid=0x0000000006ff0800 nid=0x1493d in Object.wait() [0xfffffd7e83aba000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7eea50cd80> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"Attach Listener" daemon prio=3 tid=0x0000000007b28000 nid=0x14932 waiting on condition [0x0000000000000000]
java.lang.Thread.State: RUNNABLE

"WorkManager(2)-6247" daemon prio=3 tid=0x0000000002350000 nid=0x14931 in Object.wait() [0xfffffd7e89680000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

... and so on ...

anyone had experience with thread dumps content in splunk.

Splunk is not parsing this log very well by default, i am looking for someone who already index java thread dumps and can pass some knowledge + configurations for that

Tks

0 Karma
1 Solution

avishayh
Explorer
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...