All Apps and Add-ons

Can i get JMX to connect Dynamically to a URL

robertlynch2020
Motivator

Hi

I have a process the can produce multiple JMX address on the server side.

LAUNCHERHIBERNATE - service:jmx:rmi://hp656srv.fr.murex.com:58884/jndi/rmi://hp656srv.fr.murex.com:58884/jmxrmi
LAUNCHER_WAREHOUSE - service:jmx:rmi://hp656srv.fr.murex.com:46153/jndi/rmi://hp656srv.fr.murex.com:46153/jmxrmi
etc....

I can get Splunk to read this file, but i now need it to update JMX dynamically as the URL will change each time. Is this possible. I know i can do it static, but not sure i can do it dynamically?

So if i can connect to JMX via search(SPL) this should work - so is it possible to do that?

Cheers in Advance
Robert

0 Karma

solarboyz1
Builder

As I understand your issue:
Splunk is indexing events as your process creates JMX addresses.

You want to be able to use call a custom command which will run a query against the JMX address in the event.

I would address this issue by creating a search command: http://dev.splunk.com/view/python-sdk/SP-CAAAEU2

The command you create can then be used at search time, and can take arguments based on the field in the events, which will then be run through the command.

0 Karma

robertlynch2020
Motivator

Hi

Thanks for the answer.
So i am trying to understand this.

Normally the JMX would need a lot of information to pull JMX data down, this is stored in files in the JMX app.

for example /dell425srv2/apps/splunk_old_versions/splunk_7_0_3/splunk/etc/apps/Splunk_TA_jmx/local

jmx_tasks.conf
[MUREX]
description = MUREX
disabled = 0
index = jmx
interval = 20
servers = Splunk_TA_jmx:TEST2 | Splunk_TA_jmx:TRADE_INSERTION
sourcetype = jmx
templates = Splunk_TA_jmx:MUREX

This would also need jmx_servers.conf
[TEST2]
description = TEST2
has_account = 1
interval = 60
jmx_url = service:jmx:rmi://mx12673vm:9092/jndi/rmi://mx12673vm:9092/jmxrmi

[TRADE_INSERTION]
description = TRADE_INSERTION
has_account = 1
interval = 5
jmx_url = service:jmx:rmi://hp656srv:26827/jndi/rmi://hp656srv:26827/jmxrmi

What i need is to add multiple jmx_url onto the jmx_server.conf and create an increased line in servers = Splunk_TA_jmx:TEST2 | Splunk_TA_jmx:TRADE_INSERTION + X + Y etc...

What i am not really getting is how this custom search command would work?
What would the workflow be in this case? Would it change these files or would it be something different pure command line that i could run and it would do what above is doing but on the fly?

Thanks in advance
Robert Lynch

0 Karma

solarboyz1
Builder

You asked: So if i can connect to JMX via search(SPL) this should work - so is it possible to do that?

A custom command would enable you to connect to each JMX via SPL, at search time. I had inferred you were already indexing the logged events with the JMX urls.

However, it appears you are talking about dynamically updating configurations files in the TA?

Is there a RestAPI endpoint for the stanza you are trying to edit? You could try scripting it to change via Rest.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...