Developing for Splunk Platform

index Java thread dumps using jstack

avishayh
Explorer

I am trying to index a "jstack" output in splunk of my jboss server.

the output looks like this:

2012-07-03 17:46:49
Full thread dump Java HotSpot(TM) 64-Bit Server VM (14.0-b16 mixed mode):

"Transport1" daemon prio=3 tid=0x0000000009290000 nid=0x1493f runnable [0xfffffd7e83ebe000]
java.lang.Thread.State: RUNNABLE
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.read(SocketInputStream.java:129)
at jcifs.util.transport.Transport.readn(Transport.java:29)
at jcifs.smb.SmbTransport.peekKey(SmbTransport.java:366)
at jcifs.util.transport.Transport.loop(Transport.java:96)
at jcifs.util.transport.Transport.run(Transport.java:258)
at java.lang.Thread.run(Thread.java:619)

"WorkManager(2)-6248" daemon prio=3 tid=0x0000000008f2f000 nid=0x1493e in Object.wait() [0xfffffd7e837b7000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"JMSThread(3)-6246" daemon prio=3 tid=0x0000000006ff0800 nid=0x1493d in Object.wait() [0xfffffd7e83aba000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7eea50cd80> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

"Attach Listener" daemon prio=3 tid=0x0000000007b28000 nid=0x14932 waiting on condition [0x0000000000000000]
java.lang.Thread.State: RUNNABLE

"WorkManager(2)-6247" daemon prio=3 tid=0x0000000002350000 nid=0x14931 in Object.wait() [0xfffffd7e89680000]
java.lang.Thread.State: TIMED_WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
at EDU.oswego.cs.dl.util.concurrent.BoundedLinkedQueue.poll(BoundedLinkedQueue.java:253)
- locked <0xfffffd7ee4bf43c0> (a java.lang.Object)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor.getTask(PooledExecutor.java:736)
at org.jboss.util.threadpool.MinPooledExecutor.getTask(MinPooledExecutor.java:106)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:760)
at java.lang.Thread.run(Thread.java:619)

... and so on ...

anyone had experience with thread dumps content in splunk.

Splunk is not parsing this log very well by default, i am looking for someone who already index java thread dumps and can pass some knowledge + configurations for that

Tks

0 Karma
1 Solution

avishayh
Explorer
0 Karma

avishayh
Explorer
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...