All Apps and Add-ons

How to set the host of the remote JMX node instead of Splunk indexer?

denniskline
New Member

All,

First off: very impressive app. This is going to make some of our support needs MUCH easier.

Splunk version: 6.1.1
JMX Monitor App: 204

Just a small configuration question. I have 18 servers that I would like to use this app for. When setting up the "Data Input" in "JMX (Java Management Extensions)" there is a "More settings" checkbox where a "Host field value" can be specified. It defaults to my indexer but I JMX monitor 18 other hosts. Because I'm not collecting JMX values for my indexer, the default dashboard shows blank.

Is there a way to have the host value dynamically set?

The conflicting double "host" values in the results seem to confuse splunk and i cannot search for host=foohost1
Example below where host=foohost1 and host=splunkindexer:

host=foohost1,jvmDescription="foodescription",mbean_domain="java.lang",mbean_property_type="OperatingSystem",sysLoad="4.75",sysCpuLoad="0.050360606814225314"
host = splunkindexer source = jmx://FOO sourcetype = foo-jmx

Thank you,

Dennis

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

No problem!

0 Karma

denniskline
New Member

Thank you okrabbe_splunk, your answer was perfect. It lead me to discover that I didn't update the default props.conf stanza that came with the JMX App to use my new sourcetype.

Thanks again!

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

You can dynamically set the host based on event data.

For example, in your props.conf stanza for the JMX source you would add a reference to a transform.

Then, in transforms.conf you will define that transform -

[jmx_set_host]
REGEX = host=([^,]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host

This is described in the docs:
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overridedefaulthostassignments

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...