Skip to content

Overview ↵

About the Splunk Add-on for Java Management Extensions
Version 6.0.0
Vendor Product(s) Local and remote JMX servers, MX4J HTTP-based connectors
Visible in Splunk Web Yes
Supported JDKs Oracle JDK - versions 8, 11, 17, 21, Open JDK - version 8, 11, 17, 21, IBM JDK - version 8 (IBM JDK is required when configuring data collection from IBM WAS)

Release notes

For a summary of new features, fixed issues, and known issues, see Release Notes for the Splunk Add-on for Java Management Extensions.

Compatibility

The Splunk Add-on for Java Management Extensions (JMX) allows a Splunk software administrator to poll local or remote JMX Management Servers running in Java Virtual Machines and index MBean attributes, outputs from MBean operations, and MBean notifications. This add-on provides modular inputs and Common Information Model (CIM)-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security, the Splunk App for PCI Compliance, and Splunk IT Service Intelligence.

For detailed information about compatibility with other software, CIM versions, and platforms, see Release Notes for the Splunk Add-on for Java Management Extensions.

Source types and lookups

For more information about the source types for Splunk Add-on for Java Management Extensions, see source types.

Download the add-on

Download the Splunk Add-on for Java Management Extensions from Splunkbase.

Install and configure the add-on

For information about installing and configuring the Splunk Add-on for Java Management Extensions, see Installation and configuration overview for the Splunk Add-on for Java Management Extensions.

Additional resources

See the Splunk Community page for questions related to Splunk Add-on for Java Management Extensions.

See Troubleshooting guidelines specific for this add-on.

Release notes for the Splunk Add-on for JMX

Version 6.0.0 of the Splunk Add-on for Java Management Extensions was released on .

Compatibility

Version 6.0.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 9.0.x, 9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM 5.3.2
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 6.0.0 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Python requirement updated to 3.9.3–3.9.x or 3.13.x. Python 3.7 are no longer supported.
  • Bundled dependency JARs are now copied with version-agnostic filenames (for example, log4j-core.jar instead of log4j-core-2.17.2.jar).

For information on upgrading to the newest version of this add-on, including manual steps required when upgrading from a version prior to 6.0.0, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 6.0.0 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 6.0.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Release history for the Splunk Add-on for JMX

Latest version

The latest version of the Splunk Add-on for Java Management Extensions is version 6.0.0. See Release notes for the Splunk Add-on for JMX for the release notes of this latest version.

Version 5.6.0

Version 5.6.0 of the Splunk Add-on for Java Management Extensions was released on March 12, 2025.

Compatibility

Version 5.6.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 9.0.x, 9.1.x, 9.2.x, 9.3.x, 9.4.x
CIM 5.3.2
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.6.0 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.6.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.5.1

Version 5.5.1 of the Splunk Add-on for Java Management Extensions was released on November 15, 2024.

Compatibility

Version 5.5.1 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 9.0.x, 9.1.x, 9.2.x, 9.3.x
CIM 5.3.2
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 5.5.1 of the Splunk Add-on for Java Management Extensions has the following new features:

Fixed the security vulnerabilities found in the castor 1.2 version java library by using the latest modularized version castor-xml 1.4.1 instead of it.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.5.1 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.5.1 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.5.0

Version 5.5.0 of the Splunk Add-on for Java Management Extensions was released on September 6, 2024.

Compatibility

Version 5.5.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 9.0.x, 9.1.x, 9.2.x, 9.3.x
CIM 5.3.2
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes.

New features

Version 5.5.0 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Added support for IPv6 addresses

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.5.0 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.5.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.4.0

Version 5.4.0 of the Splunk Add-on for Java Management Extensions was released on April 4, 2024.

Compatibility

Version 5.4.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 9.0.x, 9.1.x, 9.2.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.4.0 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Added support for Java 21 (openJDK, Oracle JDK and IBM WAS JDK) for data collection from JMX servers
  • Fixed the security vulnerabilities found in the certifi, urllib3, semver and postcss libraries by upgrading their version from 2022.12.7 to 2023.11.17, 1.26.12 to 1.26.18, 7.3.8 to 7.5.4, and 8.4.21 to 8.4.32 respectively.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.4.0 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.4.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.3.3

Version 5.3.3 of the Splunk Add-on for Java Management Extensions was released on March 7, 2023.

Compatibility

Version 5.3.3 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 9.0.x, 9.1.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.3.3 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Fixed the security vulnerabilities found in the certifi, urllib3, semver and postcss libraries by upgrading their version from 2022.12.7 to 2023.11.17, 1.26.12 to 1.26.18, 7.3.8 to 7.5.4, and 8.4.21 to 8.4.32 respectively.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.3.3 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.3.3 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.3.2

Version 5.3.2 of the Splunk Add-on for Java Management Extensions was released on March 7, 2023.

Compatibility

Version 5.3.2 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 8.1.x, 8.2.x, 9.0.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.3.2 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Upgraded the certifi library to version 2022.12.7
  • Fixed a security vulnerability found in the certifi library
  • Removed the “castor-xml” and “castor-core” library and used the “com.springsource.org.castor” library instead in order to resolve security vulnerability

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.3.2 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.3.2 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.3.1

Version 5.3.1 of the Splunk Add-on for Java Management Extensions was released on July 18, 2022.

Compatibility

Version 5.3.1 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 8.1.x, 8.2.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.3.1 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Added support for Java 17 for data collection from remote JMX servers.
  • Added support for polling data from JMX servers with SSL Registry configured from the server-side.
  • Upgraded the log4j library from version 2.1.6.0 to 2.17.2
  • Enhanced UI labels for server configuration.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.3.1 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.3.1 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.2.2

The JMX add-on log4j library was updated to version 2.16 in December 2021. Since then log4j has released version 2.17.1 which addresses additional vulnerabilities. These vulnerabilities are defined as moderate severity and the add-on does not use the affected code path. However, this add-on will be updated to the recommended version of 2.17.1 in an upcoming release.

Version 5.2.2 of the Splunk Add-on for Java Management Extensions was released on Dec 17, 2021.

Compatibility

Version 5.2.2 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 8.0.x, 8.1.x, 8.2.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.2.2 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Upgraded the log4j library from version 2.15.0 to 2.16.0.
  • Fixed a security vulnerability found in the log4j library

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.2.2 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.2.2 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.2.1

Version 5.2.1 of the Splunk Add-on for Java Management Extensions was released on Dec 14, 2021.

Compatibility

Version 5.2.1 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 8.0.x, 8.1.x, 8.2.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.2.1 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Change log4j version to log4j 2.15.0
  • Fixed a security vulnerability found in the log4j library

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.2.1 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.2.1 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.2.0

Version 5.2.0 of the Splunk Add-on for Java Management Extensions was released on Oct 28, 2021.

Compatibility

Version 5.2.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 8.0.x, 8.1.x, 8.2.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

Version 5.2.0 of the Splunk Add-on for Java Management Extensions has the following new features:

  • Performance improvement for IBMSoap connection type server inputs.
  • Minor bug fixes.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.2.0 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported.

Known issues

Version 5.2.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.1.0

Version 5.1.0 of the Splunk Add-on for Java Management Extensions was released on July 19, 2021.

Compatibility

Version 5.1.0.1 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 8.0.x, 8.1.x, 8.2.x
CIM 4.18.1
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations. Local process monitoring (using “PID” or “PID file” protocols) is only supported on Windows and Linux OS.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

  • Added support of Java 11 for data collection from remote JMX servers.
  • Migration to the latest Splunk UI which eliminates jQuery vulnerability and gives a fresh look to the add-on UI.
  • Dropped the support for Python2 and Splunk 7.x versions. Add-on now supports Python3 and Splunk 8.x versions only.
  • Compatibility with CIM version 4.18.1.
  • Minor bug fixes.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.1.0 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.1.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.0.1

Version 5.0.1 of the Splunk Add-on for Java Management Extensions was released on May 4, 2021.

Compatibility

Version 5.0.1 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 7.2.x, 7.3.x, 8.0.x, 8.1.x
CIM 4.17
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

  • Fixed an issue in modular input where nested stats data was not getting ingested to Splunk from IBM Websphere Application Server using the SOAP protocol.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.0.1 of the Splunk Add-on for JMX fixes the following issues. If no issues appear in this section, no issues have yet been reported:

Known issues

Version 5.0.1 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 5.0.0

Version 5.0.0 of the Splunk Add-on for Java Management Extensions was released on November 14, 2020.

Compatibility

Version 5.0.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 7.2.x, 7.3.x, 8.0.x, 8.1.0
CIM 4.17
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Note

The field alias functionality is compatible with the current version of this add-on. The current version of this add-on does not support older field alias configurations.

For more information about the field alias configuration change, refer to the Splunk Enterprise Release Notes..

New features

  • Support for data collection from IBM Websphere Application Server (WAS) using Simple Object Access Protocol (SOAP) protocol.
  • Support for using SOAP to collect data from the deployment manager of IBM WAS Network Deployment, where multiple nodes can be administered from one centralized manager.
  • Support for version 4.17 of the Common Information Model (CIM).
  • Bug fixes.

For information on upgrading to the newest version of this add-on, see the Upgrade the Splunk Add-on for JMX topic in this manual.

Fixed issues

Version 5.0.0 of the Splunk Add-on for JMX fixes the following issues:

Known issues

Version 5.0.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 4.0.0

Version 4.0.0 of the Splunk Add-on for Java Management Extensions (JMX) was released on January 31, 2020.

Compatibility

Version 4.0.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 7.0.x, 7.1.x, 7.2.x, 7.3.x, 8.0.0
CIM 4.14
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Fixed issues

Version 4.0.0 of the Splunk Add-on for JMX fixes the following issues:

Known issues

Version 4.0.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 3.3.0

Version 3.3.0 of the Splunk Add-on for Java Management Extensions was released on April 16, 2019.

Compatibility

Version 3.3.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 6.6.x, 7.0.x, 7.1.x, 7.2.x
CIM 4.12
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Fixed issues

Version 3.3.0 of the Splunk Add-on for JMX fixes the following issues:

Known issues

Version 3.3.0 of the Splunk Add-on for JMX has the following reported known issues. If no issues appear in this section, no issues have yet been reported:

Version 3.2.0

Version 3.2.0 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 6.4.X or later
CIM 4.0 or later
Platforms Platform Independent
Vendor products Local and remote JMX servers, MX4J HTTP-based connectors

Fixed issues

Version 3.2.0 of the Splunk Add-on for JMX fixes the following issues.

Known issues

Version 3.2.0 of the Splunk Add-on for JMX has the following reported known issues.

Version 3.1.1

Version 3.1.1 of the Splunk Add-on for Java Management Extensions is compatible with the following software, CIM versions, and platforms.

Component Description
Splunk platform versions 6.1 or later
CIM 4.0 or later
Platforms Platform independent
Vendor Products Local and remote JMX servers, MX4J HTTP-based connectors

Fixed issues

Version 3.1.1 of the Splunk Add-on for JMX fixes the following issues.

Known issues

Version 3.1.1 of the Splunk Add-on for JMX has the following reported known issues.

Version 3.1.0

Version 3.1.0 of the Splunk Add-on for Java Management Extensions has the same compatibility specifications as version 3.1.1.

New features

Version 3.1.0 of the Splunk Add-on for JMX has the following enhancement.

  • Change host from forwarder IP/hostname to data source ip:port or hostname:port and change source from JMX connection string (for example, service:jmx:rmi:///jindi/rmi://127.0.0.1:8888/jmxrmi) to JMX MBean ObjectName (for example, kafka.server.ReplicaManager.UnderReplicatedPartitions). This enhancement makes it easier for users to find JMX events using the source field.

Fixed issues

Version 3.1.0 of the Splunk Add-on for JMX fixes the following issues.

Known issues

Version 3.1.0 of the Splunk Add-on for JMX has the following reported known issues.

Upgrading from version 3.0.2

If you are upgrading from version 3.0.2 or any prior version of the Splunk Add-on for JMX, note that the assignment of the host and source fields has changed in the 3.1.0 release as noted in the “New Features” section above. These changes may cause existing searches to no longer work. You will need to revise your SPL searches to use the correct host or source if any of your SPL searches depend on host or source.

Migration guide

The Splunk Add-on for JMX is intended to replace the add-on components of Monitoring of Java Virtual Machines with JMX. Splunk built the Splunk Add-on for JMX as a separate add-on, so you cannot use the update function in your existing installation of the Monitoring of Java Virtual Machines with JMX app to install and use this add-on. The Splunk Add-on for JMX is compatible with the old app’s inputs.conf and XML configuration files, so you can manually upgrade and continue to use your old configurations.

Some features of the Monitoring of Java Virtual Machines with JMX app are not available in this add-on.

  • Although the element formatter still exists for backwards compatibility, the add-on does not use it. Now the add-on indexes events in JSON format for better field extractions.
  • Although the attribute filterImplementationClass still exists in element notification, the attribute is not used in this version.

This add-on does not work with the Monitoring of Java Virtual Machines with JMX app on the same Splunk Enterprise instance, so you must follow these migration steps to upgrade.

Note

If you do not want to keep your old configurations and plan to create new data inputs, you can just remove the Monitoring of Java Virtual Machines with JMX app and install this add-on.

If you want to keep your old configurations, follow these steps.

  1. Find the folder where the Monitoring of Java Virtual Machines with JMX app is installed. By default, it is $SPLUNK_HOME/etc/apps/jmx_ta.

  2. Back up your XML configuration files in the app folder or its sub-folders.

  3. Back up your inputs.conf in the local folder.

  4. If you changed your inputs.conf in the default folder, merge your changes into your backup copy of your local/inputs.conf.

  5. Backup all the other files in the local folder if you need them.

  6. Uninstall the old app, or delete the app folder.

  7. Install the Splunk Add-on for Java Management Extensions.

  8. Put your backed up copy of your local/inputs.conf into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/.

  9. Put your backed up XML configuration files into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.

  10. Check the value of configuration config_file_dir in your local/inputs.conf.

  • If you did not set any value for config_file_dir in the stanza [jmx] in the old app’s inputs.conf, the default value is now $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/. If you did set it, please change it to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  • Check the value of configuration config_file_dir in all your JMX data inputs in every app using those XML files. Make sure each data input’s config_file_dir is set to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  1. The default index is now the default index of Splunk Enterprise, instead of jmx. Also, the add-on does not include the index jmx index. If you want to use it, you need to add it manually. You also need to manually set index=jmx in all your JMX data inputs if you were using the old default value and want to continue to use jmx.

Version 3.0.2

Version 3.0.2 of the Splunk Add-on for Java Management Extensions has the same compatibility specifications as version 3.1.0.

Migration guide

The Splunk Add-on for JMX is intended to replace the add-on components of Monitoring of Java Virtual Machines with JMX. Splunk built the Splunk Add-on for JMX as a separate add-on, so you cannot use the update function in your existing installation of the Monitoring of Java Virtual Machines with JMX app to install and use this add-on. The Splunk Add-on for JMX is compatible with the old app’s inputs.conf and XML configuration files, so you can manually upgrade and continue to use your old configurations.

Some features of the Monitoring of Java Virtual Machines with JMX app are not available in this add-on.

  • Although the element formatter still exists for backwards compatibility, the add-on does not use it. Now the add-on indexes events in JSON format for better field extractions.
  • Although the attribute filterImplementationClass still exists in element notification, the attribute is not used in this version.

This add-on does not work with the Monitoring of Java Virtual Machines with JMX app on the same Splunk Enterprise instance, so you must follow these migration steps to upgrade.

Note

If you do not want to keep your old configurations and plan to create new data inputs, you can just remove the Monitoring of Java Virtual Machines with JMX app and install this add-on.

If you want to keep your old configurations, follow these steps.

  1. Find the folder where the Monitoring of Java Virtual Machines with JMX app is installed. By default, it is $SPLUNK_HOME/etc/apps/jmx_ta.

  2. Back up your XML configuration files in the app folder or its sub-folders.

  3. Back up your inputs.conf in the local folder.

  4. If you changed your inputs.conf in the default folder, merge your changes into your backup copy of your local/inputs.conf.

  5. Backup all the other files in the local folder if you need them.

  6. Uninstall the old app, or delete the app folder.

  7. Install the Splunk Add-on for Java Management Extensions.

  8. Put your backed up copy of your local/inputs.conf into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/.

  9. Put your backed up XML configuration files into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.

  10. Check the value of configuration config_file_dir in your local/inputs.conf.

  • If you did not set any value for config_file_dir in the stanza [jmx] in the old app’s inputs.conf, the default value is now $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/. If you did set it, please change it to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  • Check the value of configuration config_file_dir in all your JMX data inputs in every app using those XML files. Make sure each data input’s config_file_dir is set to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  1. The default index is now the default index of Splunk Enterprise, instead of jmx. Also, the add-on does not include the index jmx index. If you want to use it, you need to add it manually. You also need to manually set index=jmx in all your JMX data inputs if you were using the old default value and want to continue to use jmx.

Fixed issues

Version 3.0.2 of the Splunk Add-on for JMX fixed the following issues.

Known issues

Version 3.0.2 of the Splunk Add-on for JMX had the following reported known issues.

Version 3.0.1

Version 3.0.1 of the Splunk Add-on for Java Management Extensions has the same compatibility specifications as version 3.0.2.

Migration guide

The Splunk Add-on for JMX is intended to replace the add-on components of Monitoring of Java Virtual Machines with JMX. Splunk built the Splunk Add-on for JMX as a separate add-on, so you cannot use the update function in your existing installation of the Monitoring of Java Virtual Machines with JMX app to install and use this add-on. The Splunk Add-on for JMX is compatible with the old app’s inputs.conf and XML configuration files, so you can manually upgrade and continue to use your old configurations.

Some features of the Monitoring of Java Virtual Machines with JMX app are not available in this add-on.

  • Although the element formatter still exists for backwards compatibility, the add-on does not use it. Now the add-on indexes events in JSON format for better field extractions.
  • Although the attribute filterImplementationClass still exists in element notification, the attribute is not used in this version.

This add-on does not work with the Monitoring of Java Virtual Machines with JMX app on the same Splunk Enterprise instance, so you must follow these migration steps to upgrade.

Note

If you do not want to keep your old configurations and plan to create new data inputs, you can just remove the Monitoring of Java Virtual Machines with JMX app and install this add-on.

If you want to keep your old configurations, follow these steps.

  1. Find the folder where the Monitoring of Java Virtual Machines with JMX app is installed. By default, it is $SPLUNK_HOME/etc/apps/jmx_ta.

  2. Back up your XML configuration files in the app folder or its sub-folders.

  3. Back up your inputs.conf in the local folder.

  4. If you changed your inputs.conf in the default folder, merge your changes into your backup copy of your local/inputs.conf.

  5. Backup all the other files in the local folder if you need them.

  6. Uninstall the old app, or delete the app folder.

  7. Install the Splunk Add-on for Java Management Extensions.

  8. Put your backed up copy of your local/inputs.conf into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/.

  9. Put your backed up XML configuration files into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.

  10. Check the value of configuration config_file_dir in your local/inputs.conf.

  • If you did not set any value for config_file_dir in the stanza [jmx] in the old app’s inputs.conf, the default value is now $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/. If you did set it, please change it to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  • Check the value of configuration config_file_dir in all your JMX data inputs in every app using those XML files. Make sure each data input’s config_file_dir is set to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  1. The default index is now the default index of Splunk Enterprise, instead of jmx. Also, the add-on does not include the index jmx index. If you want to use it, you need to add it manually. You also need to manually set index=jmx in all your JMX data inputs if you were using the old default value and want to continue to use jmx.

Fixed issues

Version 3.0.1 of the Splunk Add-on for JMX fixed the following issues.

Known issues

Version 3.0.1 of the Splunk Add-on for JMX had the following reported known issues.

Version 3.0.0

Version 3.0.0 of the Splunk Add-on for JMX has the same compatibility specifications as version 3.0.1.

Migration guide

The Splunk Add-on for JMX is intended to replace the add-on components of Monitoring of Java Virtual Machines with JMX. Splunk built the Splunk Add-on for JMX as a separate add-on, so you cannot use the update function in your existing installation of the Monitoring of Java Virtual Machines with JMX app to install and use this add-on. The Splunk Add-on for JMX is compatible with the old app’s inputs.conf and XML configuration files, so you can manually upgrade and continue to use your old configurations.

Some features of the Monitoring of Java Virtual Machines with JMX app are not available in this add-on.

  • Although the element formatter still exists for backwards compatibility, the add-on does not use it. Now the add-on indexes events in JSON format for better field extractions.
  • Although the attribute filterImplementationClass still exists in element notification, the attribute is not used in this version.

This add-on does not work with the Monitoring of Java Virtual Machines with JMX app on the same Splunk Enterprise instance, so you must follow these migration steps to upgrade.

Note

If you do not want to keep your old configurations and plan to create new data inputs, you can just remove the Monitoring of Java Virtual Machines with JMX app and install this add-on.

If you want to keep your old configurations, follow these steps.

  1. Find the folder where the Monitoring of Java Virtual Machines with JMX app is installed. By default, it is $SPLUNK_HOME/etc/apps/jmx_ta.

  2. Back up your XML configuration files in the app folder or its sub-folders.

  3. Back up your inputs.conf in the local folder.

  4. If you changed your inputs.conf in the default folder, merge your changes into your backup copy of your local/inputs.conf.

  5. Backup all the other files in the local folder if you need them.

  6. Uninstall the old app, or delete the app folder.

  7. Install the Splunk Add-on for Java Management Extensions.

  8. Put your backed up copy of your local/inputs.conf into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/.

  9. Put your backed up XML configuration files into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.

  10. Check the value of configuration config_file_dir in your local/inputs.conf:

  • If you did not set any value for config_file_dir in the stanza [jmx] in the old app’s inputs.conf, the default value is now $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/. If you did set it, please change it to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  • Check the value of configuration config_file_dir in all your JMX data inputs in every app using those XML files. Make sure each data input’s config_file_dir is set to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  1. The default index is now the default index of Splunk Enterprise, instead of jmx. Also, the add-on does not include the index jmx index. If you want to use it, you need to add it manually. You also need to manually set index=jmx in all your JMX data inputs if you were using the old default value and want to continue to use jmx.

New features

Version 3.0.0 of the Splunk Add-on for JMX has the following new features.

  • Newly Splunk-supported.
  • Improved UI.
  • New predefined templates provided in the add-on to help users get started defining data collection parameters.
  • Users can configure the log level.
  • Replaced modular input configuration UI with new interface for configuring tasks and their components.
  • Users can import trust certification for connecting to a JMX server with SSL.
  • Indexed events mapped to the JVM data model of the Splunk CIM.
  • Support for scheduling JMX tasks in the configuration files.
  • Support for defining JMX servers in the configuration files.
  • Support for one task to pull data from multiple servers using multiple templates.
  • Support for configuration under specific app namespaces in the UI.
  • Support for management of legacy tasks inherited from previous versions of the add-on in the UI.
  • Validation for input fields in the UI.
  • When a user updates backend configuration files, the UI is updated automatically.
  • When a user updates backend configuration files, affected tasks are automatically refreshed and loaded.
  • Support for third-party app’s JMX templates in configuration files and in the UI.
  • New UI page for configuring tasks.
  • New UI page for configuring templates.
  • New UI page for configuring server connection details.
  • Support for secure credential management for server access. Credentials are secured automatically in the configuration UI. For secure credential management in the XML configuration file, use the jmxaccount attribute.
  • The add-on ships with a set of pre-built panels.
  • Backwards compatibility with the Monitoring of Java Virtual Machines with JMX app. |
  • Support for different polling intervals for each server, MBean, Attribute, and Operation.

Known issues

Version 3.0.0 of the Splunk Add-on for JMX has the following reported known issues.

Third-party software attribution

Some versions of Splunk Add-on for Java Management Extensions use third-party software components. For more details, see Third-party credits.

Installation and configuration overview for the Splunk Add-on for JMX

To install and configure this add-on, follow these steps:

  1. Optionally set your $JAVA_HOME environment variable to the root directory of your JRE installation. If you don’t set this, the Splunk Add-on for JMX looks for a default installed Java executable on the path.

  2. Install the add-on.

    Note

    If you are migrating from the app Monitoring of Java Virtual Machines with JMX, follow the migration guide.

  3. Prepare your JMX servers so that Splunk Enterprise can get data from them using the add-on’s modular input. To collect data from IBM Websphere application servers using Simple Object Access Protocol (SOAP), see the Connect with IBM Websphere Application Server topic in this manual.

  4. Next, configure your inputs.

Ended: Overview

Installation ↵

Install the Splunk Add-on for JMX

  1. Get the Splunk Add-on for JMX by downloading it from Splunkbase or browsing to it using the app browser within Splunk Web.
  2. Determine where and how to install this add-on in your deployment, using the following tables on this page.
  3. Perform any prerequisite steps before installing, if required and specified in the following tables.
  4. Complete your installation.

If you need step-by-step instructions on how to install an add-on in your specific deployment environment, see the installation walkthroughs for links to installation instructions specific to a single-instance deployment, distributed deployment, Splunk Cloud, or Splunk Light.

Distributed deployments

Use the following tables to determine where and how to install this add-on in a distributed deployment of Splunk Enterprise or any deployment for which you are using forwarders to get your data in. Depending on your environment, your preferences, and the requirements of the add-on, you may need to install the add-on in multiple places.

While it is possible to use the add-on to poll remote JMX management servers, Splunk recommends installing this add-on on a heavy forwarder that is installed on the same host as the central JMX server. This deployment configuration simplifies your configuration because you can call the port locally, you do not need to use certificates, and you can use the Java version that is local to the machine.

Where to install this add-on

This table provides a quick reference for installing this add-on to a distributed deployment of Splunk Enterprise.

Splunk instance type Supported Required Comments
Search Heads Yes Yes Install this add-on to all search heads where JMX knowledge management is required.
Indexers Yes No Not required, as the parsing operations occur on the heavy forwarders.
Heavy Forwarders Yes Yes This add-on requires heavy forwarders to perform data collection.
Universal Forwarders No No This add-on requires heavy or light forwarders.

Distributed deployment feature compatibility

This table provides a quick reference for the compatibility of this add-on with Splunk distributed deployment features.

Distributed deployment feature Supported Comments
Search Head Clusters Yes You can install this add-on on a search head cluster for all search-time functionality, but only configure inputs on forwarders to avoid duplicate data collection.
Before installing this add-on to a cluster, make the following changes to the add-on package:
Remove the inputs.conf file.
Indexer Clusters Yes Before installing this add-on to a cluster, make the following changes to the add-on package:
Remove the inputs.conf file.
Deployment Server No Supported for deploying unconfigured add-on only. Using a deployment server to deploy the configured add-on to multiple forwarders acting as data collectors causes duplication of data.

Installation walkthroughs

The Splunk Add-Ons manual includes an Installing add-ons guide that helps you successfully install any Splunk-supported add-on to your Splunk platform.

For a walkthrough of the installation procedure, follow the link that matches your deployment scenario:

Upgrade the Splunk Add-on for JMX

Upgrade from version 5.6.0 or earlier to version 6.0.0 or higher

Splunk Add-on for Java Management Extensions version 6.0.0 and higher does not include urllib3, and requests, due to security reasons.

However, Splunk Enterprise architectural decisions do not allow modules introduced by previous versions of the add-on to be deleted automatically during upgrade.

Splunk administrators must manually delete the following directories from all Splunk servers where the add-on was upgraded:

  • Splunk_TA_jmx/lib/urllib3

  • Splunk_TA_jmx/lib/urllib3-*.dist-info

  • Splunk_TA_jmx/lib/requests

  • Splunk_TA_jmx/lib/requests-*.dist-info

This ensures that the urllib3 and requests modules built into Splunk Python are used.

  1. Disable all currently configured inputs.
  2. In Splunk Web, navigate to the Manage Apps page.
  3. Navigate to the Splunk Add-on for Java Management Extensions and click the link to upgrade to the latest version of the add-on.
  4. SSH into the Splunk machine where the add-on is installed.
  5. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory on the heavy forwarder.

  6. Delete the following files, if they exist:

    • log4j-api-x.x.x.jar
    • log4j-core-x.x.x.jar

  7. Restart your Splunk platform instance.

  8. Enable the inputs.

Upgrade to version 5.6.0 and above from version 5.4.0 or lower

  1. Disable all currently configured inputs.
  2. In Splunk Web, navigate to the Manage Apps page.
  3. Navigate to the Splunk Add-on for Java Management Extensions and click the link to upgrade to the latest version of the add-on.
  4. SSH into the Splunk machine where the add-on is installed.
  5. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory on the heavy forwarder.

  6. Delete the following files, if they exist:

    • castor-core-1.4.1.jar
    • castor-xml-1.4.1.jar
    • commons-lang3-3.12.0.jar
    • xercesImpl-2.12.0.SP03.jar

  7. Restart your Splunk platform instance.

  8. Enable the inputs.

Upgrade to version 5.4.0 and above from version 5.2.2 or lower

  1. Disable all currently configured inputs.
  2. In Splunk Web, navigate to the Manage Apps page.
  3. Navigate to the Splunk Add-on for Java Management Extensions and click the link to upgrade to the latest version of the add-on.
  4. SSH into the Splunk machine where the add-on is installed.
  5. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory on the heavy forwarder.

  6. Delete the following files, if they exist:

    • fastjson-1.2.76.jar
    • fastjson-1.2.60.jar
    • fastjson-1.2.5.jar
    • commons-discovery-0.2.jar
    • commons-logging-1.1.1.jar
    • jakarta.activation.jar
    • log4j-api-2.11.1.jar
    • log4j-core-2.11.1.jar
    • log4j-api-2.14.1.jar
    • log4j-core-2.14.1.jar
    • log4j-api-2.15.0.jar
    • log4j-core-2.15.0.jar
    • log4j-api-2.16.0.jar
    • log4j-core-2.16.0.jar
    • xercesImpl.jar

  7. Restart your Splunk platform instance.

  8. Enable the inputs.

Upgrade to version 5.2.2 from version 5.2.1 or lower

  1. Disable all currently configured inputs.
  2. In Splunk Web, navigate to the Manage Apps page.
  3. Navigate to the Splunk Add-on for Java Management Extensions and click the link to upgrade to the latest version of the add-on.
  4. SSH into the Splunk machine where the add-on is installed.
  5. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory on the heavy forwarder.

  6. Delete the following files, if they exist:

    • fastjson-1.2.60.jar
    • fastjson-1.2.5.jar
    • commons-discovery-0.2.jar
    • commons-logging-1.1.1.jar
    • jakarta.activation.jar
    • log4j-api-2.11.1.jar
    • log4j-core-2.11.1.jar
    • log4j-api-2.14.1.jar
    • log4j-core-2.14.1.jar
    • log4j-api-2.15.0.jar
    • log4j-core-2.15.0.jar
    • xercesImpl.jar

  7. Restart your Splunk platform instance.

  8. Enable the inputs.

Upgrade to version 5.2.1 from version 5.2.0 or lower

  1. Disable all currently configured inputs.
  2. In Splunk Web, navigate to the Manage Apps page.
  3. Navigate to the Splunk Add-on for Java Management Extensions and click the link to upgrade to the latest version of the add-on.
  4. SSH into the Splunk machine where the add-on is installed.
  5. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory on the heavy forwarder.

  6. Delete the following files, if they exist:

    • fastjson-1.2.60.jar
    • fastjson-1.2.5.jar
    • commons-discovery-0.2.jar
    • commons-logging-1.1.1.jar
    • jakarta.activation.jar
    • log4j-api-2.11.1.jar
    • log4j-core-2.11.1.jar
    • log4j-api-2.14.1.jar
    • log4j-core-2.14.1.jar
    • junit-4.11.jar
    • xercesImpl.jar

  7. Restart your Splunk platform instance.

  8. Enable the inputs.

Upgrade to version 5.2.0 from version 5.1.0 or lower

  1. Disable all currently configured inputs.
  2. In Splunk Web, navigate to the Apps page.
  3. Navigate to the Splunk Add-on for Java Management Extensions and click the link to upgrade to the latest version of the add-on.
  4. Accept the terms and agreements.
  5. Log in with your Splunk.com credentials.
  6. Restart your Splunk platform deployment.
  7. SSH in to the Splunk machine where the add-on is installed.
  8. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory.

  9. Delete the following files, if they exist:

    • fastjson-1.2.60.jar
    • fastjson-1.2.5.jar
    • commons-discovery-0.2.jar
    • commons-logging-1.1.1.jar
    • jakarta.activation.jar
    • log4j-api-2.11.1.jar
    • log4j-core-2.11.1.jar
    • junit-4.11.jar
    • xercesImpl.jar

  10. Restart your Splunk platform instance.

  11. Enable the inputs.

Upgrade from version 3.0.2

If you are upgrading from version 3.0.2 or earlier of the Splunk Add-on for JMX, note that the assignment of the host and source fields has changed since the 3.1.0 release as noted in ADDON-5508. These changes may cause existing searches to no longer work. You will need to revise your SPL searches to use the correct host or source if any of your SPL searches depend on host or source.

Migration guide

The Splunk Add-on for JMX is intended to replace the add-on components of Monitoring of Java Virtual Machines with JMX. Splunk built the Splunk Add-on for JMX as a separate add-on, so you cannot use the update function in your existing installation of the Monitoring of Java Virtual Machines with JMX app to install and use this add-on. The Splunk Add-on for JMX is compatible with the old app’s inputs.conf and XML configuration files, so you can manually upgrade and continue to use your old configurations.

Some features of the Monitoring of Java Virtual Machines with JMX app are not available in this add-on.

  • Although the element formatter still exists for backwards compatibility, the add-on does not use it. Now the add-on indexes events in JSON format for better field extractions.
  • Although the attribute filterImplementationClass still exists in element notification, the attribute is not used in this version.

This add-on does not work with the Monitoring of Java Virtual Machines with JMX app on the same Splunk Enterprise instance, so you must follow these migration steps to upgrade.

Note

If you do not want to keep your old configurations and plan to create new data inputs, you can just remove the Monitoring of Java Virtual Machines with JMX app and install this add-on.

If you want to keep your old configurations, follow these steps:

  1. Find the folder where the Monitoring of Java Virtual Machines with JMX app is installed. By default, it is $SPLUNK_HOME/etc/apps/jmx_ta.
  2. Back up your XML configuration files in the app folder or its sub-folders.
  3. Back up your inputs.conf in the local folder.
  4. If you changed your inputs.conf in the default folder, merge your changes into your backup copy of your local/inputs.conf.
  5. Backup all the other files in the local folder if you need them.
  6. Uninstall the old app, or delete the app folder.
  7. Install the Splunk Add-on for Java Management Extensions.
  8. Put your backed up copy of your local/inputs.conf into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/.
  9. Put your backed up XML configuration files into $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  10. Check the value of configuration config_file_dir in your local/inputs.conf.
    • If you did not set any value for config_file_dir in the stanza [jmx] in the old app’s inputs.conf, the default value is now $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/. If you did set it, change it to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
    • Check the value of configuration config_file_dir in all your JMX data inputs in every app using those XML files. Make sure each data input’s config_file_dir is set to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/config/.
  11. The default index is now the default index of Splunk Enterprise, instead of jmx. The add-on does not include the index jmx index. If you want to use it, you must add it manually. You also need to manually set index=jmx in all your JMX data inputs if you were using the old default value and want to continue to use jmx.

Ended: Installation

Configuration ↵

Prepare JMX servers for the Splunk Add-on for JMX

Before you configure your inputs, prepare your JMX servers for connectivity with the Splunk platform. Depending on how you want to set up your inputs for each server, you may need to configure connectivity in different ways for different servers.

Connect to a local JVM using a process ID

When connecting directly to local JVM using a process ID, the JRE uses a native library called attach.dll on Windows and libattach.so on Linux. In Windows, the library is located at %JRE_HOME%\bin\attach.dll In Linux, the library is located at $JDK_HOME/jre/lib/i386/libattach.so

  1. Depending on your operating system, use one of the following methods:

    • If you are using Windows, add %JAVA_HOME%\jdk1.x.x_xx\jre\bin\ to the environment variable %PATH%.
    • If you are using Linux, the attach library is only packaged in the JRE that is part of a JDK install. If you do not have libattach.so, you can get it from the JDK($JDK_HOME/lib/) and copy it into the JRE’s lib ($JDK_HOME/jre/lib/) directory.

  2. (Optional) To use this method to connect to your local JVMs when you configure your data inputs for this add-on, select one of the three connection type options under Attach to process when you add a server. For more information, see Configure the inputs for the Splunk Add-on for JMX.

Get process id from service name

Use the following command to get the process id of any service:

ps -eafH | grep "java" | grep "{your_service_name}" | grep -v "grep" | awk '{print $2}'

Connect to a local or remote JMX server through system properties

To set up a JMX server for remote access, follow the instructions in the Oracle documentation: http://download.oracle.com/javase/1.5.0/docs/guide/management/agent.html#remote.

Select either rmi or iiop as your connection type when you configure your inputs if you use this method to connect to your local or remote JVMs. For more information, see Configure the inputs for the Splunk Add-on for JMX.

Connect to a local or remote JMX server using MX4J

The Splunk Add-on for JMX supports MX4J as the JMX implementation for remote connectors (rmi and iiop). You can also use any of the MX4J-specific JMX connectors (soap, burlap, hessian).

Note

If you use Java 8 or 11, remote method invocation (RMI) is the only supported set of MX4J protocols.

Select the MX4J-specific JMX connector that you use as your connection type when you configure your inputs if you use this method to connect to your local or remote JVMs. For more information, see Configure the inputs for the Splunk Add-on for JMX.

Note

If you are using any of the HTTPS connectors (soap+ssl, hessian+ssl, burlap+ssl), the root certification authority should be present in the trusted certificates, normally stored in the $JAVA_HOME/jre/lib/security/cacerts file.

To connect to a JMX server with SSL, follow these steps.

Prerequisite

Generate Server certificates

  1. Export the server certification to a file. Use the keytool utility provided by Java to generate the SSL certificate. The following example uses the filename server.cer:> keytool -export -keystore <server_key_store> -alias <key_alias> -file server.cer
  2. Copy the file to the machine running Splunk Enterprise.
  3. Create a keystore file, set your password, name it mx4j.ks and put it under $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin.
  4. Import server.cer into mx4j.ks using your password. > keytool -import -keystore mx4j.ks -alias <key_alias> -file server.cer By using this command, you can append other certificates in the mx4j.ks file for use by the Splunk Add-on for Java Management Extension.
  5. Add the password to access certificates in the mx4j.ks file through the UI from the menu for Splunk add-on for JMX Configuration > Java System Properties > TrustStore Password.
  6. Restart Splunk Enterprise.

Generate Client certificates

  1. Export the client certification to a file. Use the keytool utility provided by Java to generate the SSL certificate. The following example uses the filename server.cer:> keytool -export -keystore <client_key_store> -alias <key_alias> -file client.cer
  2. Copy the file to the machine running Splunk Enterprise.
  3. Create a keystore file, set your password, name it jmx_client.ks and put it under $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin.
  4. Import client.cer into jmx_client.ks using your password. > keytool -import -keystore jmx_client.ks -alias <key_alias> -file client.cer By using this command, you can append other certificates in the jmx_clientj.ks file for use by the Splunk Add-on for Java Management Extension.
  5. Add the password to access certificates in the jmx_client.ks file through the UI from the menu for Splunk add-on for JMX Configuration > Java System Properties > KeyStore Password.
  6. Restart Splunk Enterprise.

Note

Use client certificates when you want to have a fully secure RMI Registry between your server and client. You must update server configurations as well as any applicable properties.

Provide passwords for certificates stored in the Keystore and Truststore

Property Meaning Default value
TrustStore password The password to access the jmx_client.ks file under Splunk_TA_jmx/bin/. This would contain the client certificates.
KeyStore password The password to access the mx4j.ks file under Splunk_TA_jmx/bin/. This would contain the server certificates.
Certificate Length Maximum number of certificates that can be stored in a keystore. 10

Next, configure your inputs.

Connect the Splunk Add-on for Java Management Extensions to IBM Websphere Application Server

Configure the Splunk Add-on for Java Management Extensions (JMX) to connect to IBM Websphere Application Server.

Note

You must install the IBM Java Development Kit (JDK) or Java Runtime Environment (JRE) to collect JMX data from an IBM WebSphere application server. Put the JDK or JRE bin directory in the system path to make sure that the JMX data collection uses this IBM version of the Java runtime. See the IBM developer site to download the IBM JRE or JDK.

  1. In your IBM WebSphere installation directory, navigate to $WAS_ROOT/WebSphere/AppServer/runtimes.
  2. Copy the following files:
    • com.ibm.ws.admin.client_*.jar
    • com.ibm.ws.ejb.thinclient_*.jar
    • com.ibm.ws.orb_*.jar
  3. Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib in your Splunk platform instance.
  4. Paste the files in the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory.

  5. After copying, verify the files successfully copied to your $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib directory before continuing. For example, if you run the following command: ls /opt/splunk/etc/apps/Splunk_TA_jmx/bin/lib/com.ibm*

    You should see result similar to the following example:

    /opt/splunk/etc/apps/Splunk_TA_jmx/bin/lib/com.ibm.ws.admin.client_8.5.0.jar
/opt/splunk/etc/apps/Splunk_TA_jmx/bin/lib/com.ibm.ws.ejb.thinclient_8.5.0.jar
/opt/splunk/etc/apps/Splunk_TA_jmx/bin/lib/com.ibm.ws.orb_8.5.0.jar

  6. Restart the Splunk platform.

Connect the Splunk Add-on for Java Management Extensions to IBM Websphere Application Server through SOAP protocol

Connect the Splunk Add-on for Java Management Extensions to IBM Websphere Application Server (WAS) using Simple Object Access Protocol (SOAP).

Prerequisite: Perform the default configuration steps listed in the previous section of this topic before you configure the Splunk Add-on for Java Management Extensions to connect using the SOAP protocol.

  1. Navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/config.
  2. Create a directory with a name that starts with any letter and consists only of underscores and alphanumeric characters. The same name must also be used when you configure your IBM WAS server. For example, .
  3. In your IBM WebSphere Application Server deployment, navigate to $WAS_ROOT/WebSphere/AppServer/profiles/<AppSrv>/properties.
  4. Copy the following files:
    • ssl.client.props
    • soap.client.props
  5. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/config/<directory_name> directory created at the beginning of this procedure.
  6. Paste the props files.
  7. In your IBM WebSphere Application Server deployment, navigate to $WAS_ROOT/WebSphere/AppServer/profiles/<AppSrv>/etc
  8. Copy the following files:
    • key.p12
    • trust.p12
  9. Navigate to the $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/config/<directory_name> directory created at the beginning of this procedure.
  10. Paste the files.

  11. In a text editor, open the ssl.client.props file and provide the correct path of your key.p12 and trust.p12 files: com.ibm.ssl.keyStore=$SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/config/<directory_name>/key.p12 com.ibm.ssl.trustStore=$SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local/config/<directory_name>/trust.p12

  12. Follow the Configure servers procedure, and select the Connection Type as IBMsoap.

    • Data can be collected directly from the deployment manager of your IBM WAS Network deployment. If you use a deployment manager, data from each node of the deployment manager can be collected by entering the credentials of the deployment manager (DMGR) when configuring the server.
  13. Configure a task in the Splunk Add-on for Java Management Extensions. See the Configure inputs topic in this manual. Use the Predefined_IBM_WAS_Performance_Template template to collect performance data from your IBM WAS servers.

Note

Connection to the IBM WAS using IBMsoap connection type is only supported when SSL and authentication is enabled on the IBM WebSphere Application Server. MBean notification listening is not supported for this configuration type, and any notificationListener element present in any Mbean will be ignored.

Enable PMI data collection on IBM WAS

  1. Open the IBM Websphere Application Server (WAS) Admin Web Console.
  2. Navigate to IBM WAS Admin Console > Monitoring and Tuning > Performance Monitoring Infrastructure (PMI) > <ibm_server_name> and ensure that PMI data collection is enabled in IBM WAS.
  3. Save any changes.

Configure inputs for the Splunk Add-on for JMX in Splunk Web

The Splunk Add-on for Java Management Extensions (JMX) collects data using a modular input. Configure this input using Splunk Web on the data collection node (best practice) or manually using the configuration files.

Configure inputs through Splunk Web

Access the input configuration in Splunk Web on your data collection node, usually a heavy forwarder, by going to Apps > Manage Apps, then clicking Launch app in the row for Splunk Add-on for JMX.

There are three parts of the input configuration: Servers, Templates, and Tasks. Toggle between them using the Configurations menu in the upper left of the screen.

Configure servers

  1. Click Add Server to provide connection details for a JMX server.
  2. Keep the default Destination App to associate the server with the Splunk Add-on for JMX.
  3. Provide a Name and JVM Description to help identify this server. The description is optional metadata which Splunk Enterprise sets as the value for the field jvmDescription in your events.

  4. Select a Connection Type and fill in the required fields, described in the following table. The three options under Attach to process are for local JMX servers only. See Connect to a local JVM using a process ID for setup instructions. You can select a Specific protocol for either local or remote servers.

    Note

    In all connection type options, you do not need to fill in a username and password unless your JMX server is protected by authentication. The add-on does not require values for these fields. If you provide a password and return later to make changes, the field is blank and you must re-enter the password before saving.

    Category Connection type Description
    Attach to process Customized script At runtime, the add-on runs the executable shell script (or bat file on Windows) that you specify in Script Path. You must have privileges to execute the script. The script should print several lines, each line representing a JVM process. A line can be either a Process ID or a Process ID followed by a comma (“,”) and a jvmDescription which does not contain a comma.
    Attach to process Process id At runtime, the add-on attaches to the Process ID that you specify here. See Get process id from service name.
    Attach to process Process file At runtime, the add-on reads the first line of the file that you specify in the File Path to find the Process ID of your JVM.
    Specific protocol Use URL directly The add-on accesses your local or remote JVM server using the raw JMX service URL in the standard format: service:jmx:protocol:sap. Fill in the URL, Username, and Password.
    Specific protocol RMI The add-on uses Remote Method Invocation (RMI) to connect to your JMX server using system properties. Select a Stub Source and fill in the required fields. For JNDI or “JNDI over Registry SSL”, provide a Host, Port, and Lookup Path. For IOR or Stub, provide the Encoded Stub, Username, and Password.
    Specific protocol IIOP The add-on uses Java Remote Method Invocation (RMI) interface over the Internet Inter-Orb Protocol (IIOP) to connect to your JMX server using system properties. Select a Stub Source and fill in the required fields. For JNDI, provide a Host, Port, and Lookup Path. For IOR or Stub, provide the Encoded Stub, Username, and Password.
    Specific protocol SOAP The add-on uses the soap MX4J JMX connector to connect to your JMX server. Fill in the Host, Port, Lookup Path, Username, and Password.
    Specific protocol IBMsoap The add-on uses IBM API to connect to your IBM Websphere Application Server (WAS) using Simple Object Access Protocol (SOAP) protocol. Fill in the Host, Port, Username, and Password. Follow the prerequisite steps Connect to IBM Websphere Application Server (WAS) through SOAP protocol before you configure your server using this Connection Type.
    Specific protocol SOAP with SSL The add-on uses the soap MX4J JMX connector to connect to your JMX server with SSL. Fill in the Host, Port, Lookup Path, Username, and Password.
    Specific protocol Hessian The add-on uses the hessian MX4J JMX connector to connect to your JMX server. Fill in the Host, Port, Lookup Path, Username, and Password.
    Specific protocol Hessian with SSL The add-on uses the hessian MX4J JMX connector to connect to your JMX server with SSL. Fill in the Host, Port, Lookup Path, Username, and Password.
    Specific protocol Burlap The add-on uses the burlap MX4J JMX connector to connect to your JMX server. Fill in the Host, Port, Lookup Path, Username, and Password.
    Specific protocol Burlap with SSL The add-on uses the burlap MX4J JMX connector to connect to your JMX server with SSL. Fill in the Host, Port, Lookup Path, Username, and Password.

  5. (Optionally) Fill in a value in Server Interval to specify the collection interval for this server, in seconds. This value overrides the interval of the task that contains this server, but only for this server. Any other servers in the same task still follow the interval set in the task.

  6. Click Create. Continue to add additional servers until you have configured connection details for all of the JMX servers from which you want the add-on to extract data.

Configure templates

A template describes a group of JMX MBeans from which the add-on should pull data.

To create a new template, follow these steps:

  1. Click Configurations > Templates to access the template configuration screen.
  2. Click Add Template to create a new template.
  3. Keep the default Destination App to associate the template with the Splunk Add-on for JMX.
  4. Give your template a Name using only alphanumeric characters and underscores.
  5. Enter a brief Description for your template to indicate its function.
  6. In the Content field, enter one or more MBean configurations in XML format. For detailed guidance on how to structure the MBean configurations, see MBean configuration XML reference.
  7. Click Create. You can now apply this template to one or more tasks by following the instructions in the following section.

The add-on includes three predefined templates. The Predefined_Get_All_Template contains MBean configurations that instruct the add-on to pull all Attributes.

<mbean domain="*" properties="*" dumpAllAttributes="true" ></mbean>

The Predefined_JVM_Template contains a set of MBean configurations that poll for specific Attributes. You can copy and paste the content of this template into a new template, then edit to match your specific use case.

<mbean domain="java.lang" properties="type=Threading">

<!-- simple attributes -->
<attribute name="TotalStartedThreadCount" outputname="started"/>
<attribute name="ThreadCpuTimeSupported" outputname="cpuTimeSupported"/>
<attribute name="ThreadCpuTimeEnabled" outputname="cpuTimeEnabled"/>
<attribute name="ThreadCount" outputname="count"/>
<attribute name="ThreadContentionMonitoringSupported" outputname="cmSupported"/>
<attribute name="ThreadContentionMonitoringEnabled" outputname="cmEnabled"/>
<attribute name="SynchronizerUsageSupported" outputname="synchSupported"/>
<attribute name="PeakThreadCount" outputname="peak"/>
<attribute name="ObjectMonitorUsageSupported" outputname="omuSupported"/>
<attribute name="DaemonThreadCount" outputname="daemonCount"/>
<attribute name="CurrentThreadUserTime" outputname="currentUserTime"/>
<attribute name="CurrentThreadCpuTimeSupported" outputname="cpuTimeSupported"/>
<attribute name="CurrentThreadCpuTime" outputname="currentCPUTime"/>

</mbean>

<mbean domain="java.lang" properties="type=Runtime">

<!-- tabular attributes -->
<attribute name="SystemProperties:user.timezone:value" outputname="timezone"/>
<attribute name="SystemProperties:java.vm.vendor:value" outputname="jvmVendor"/>

<!-- simple attributes -->
<attribute name="VmVersion" outputname="jvmVersion"/>
<attribute name="VmVendor" outputname="jvmVendor"/>
<attribute name="VmName" outputname="jvmName"/>
<attribute name="Uptime" outputname="jvmUptime"/>
<attribute name="StartTime" outputname="startedAt"/>
<attribute name="Name" outputname="jvmProcessName"/>

<!-- simple array attribute -->
<attribute name="InputArguments" outputname="inputArgs"/>

</mbean>

<mbean domain="java.lang" properties="type=OperatingSystem">

<!-- simple attributes -->
<attribute name="Version" outputname="version"/>
<attribute name="TotalSwapSpaceSize" outputname="swapSpace"/>
<attribute name="TotalPhysicalMemorySize" outputname="physMem"/>
<attribute name="SystemLoadAverage" outputname="sysLoad"/>
<attribute name="ProcessCpuTime" outputname="cpuTime"/>
<attribute name="OpenFileDescriptorCount" outputname="openFD"/>
<attribute name="Name" outputname="name"/>
<attribute name="MaxFileDescriptorCount" outputname="maxFD"/>
<attribute name="FreeSwapSpaceSize" outputname="freeSwap"/>
<attribute name="FreePhysicalMemorySize" outputname="freePhysMem"/>
<attribute name="CommittedVirtualMemorySize" outputname="committed"/>
<attribute name="AvailableProcessors" outputname="processors"/>
<attribute name="Arch" outputname="arch"/>

</mbean>

<mbean domain="java.lang" properties="type=Compilation">

<!-- simple attributes -->
<attribute name="TotalCompilationTime" outputname="time"/>

</mbean>

<mbean domain="java.lang" properties="type=ClassLoading">

<!-- simple attributes -->
<attribute name="TotalLoadedClassCount" outputname="total"/>
<attribute name="LoadedClassCount" outputname="current"/>
<attribute name="UnloadedClassCount" outputname="unloaded"/>

</mbean>

<mbean domain="java.lang" properties="type=Memory">

<!-- composite attributes -->
<attribute name="NonHeapMemoryUsage:used" outputname="nonHeapUsed"/>
<attribute name="NonHeapMemoryUsage:max" outputname="nonHeapMax"/>
<attribute name="NonHeapMemoryUsage:init" outputname="nonHeapInit"/>
<attribute name="NonHeapMemoryUsage:committed" outputname="nonHeapCommitted"/>

<attribute name="HeapMemoryUsage:used" outputname="heapUsed"/>
<attribute name="HeapMemoryUsage:max" outputname="heapMax"/>
<attribute name="HeapMemoryUsage:init" outputname="heapInit"/>
<attribute name="HeapMemoryUsage:committed" outputname="heapCommitted"/>

<attribute name="ObjectPendingFinalizationCount" outputname="objectsPending"/>

</mbean>

<mbean domain="java.lang" properties="type=MemoryPool,name=*">

<attribute name="Name" outputname="name"/>
<attribute name="Type" outputname="memoryType"/>
<attribute name="MemoryManagerNames" outputname="memManagerNames"/>

<attribute name="PeakUsage:used" outputname="peakUsageUsed"/>
<attribute name="PeakUsage:max" outputname="peakUsageMax"/>
<attribute name="PeakUsage:committed" outputname="peakUsageCommitted"/>
<attribute name="PeakUsage:init" outputname="peakUsageInit"/>

<!-- composite attributes -->
<attribute name="CollectionUsage:used" outputname="colUsageUsed"/>
<attribute name="CollectionUsage:max" outputname="colUsageMax"/>
<attribute name="CollectionUsage:committed" outputname="colUsageCommitted"/>
<attribute name="CollectionUsage:init" outputname="colUsageInit"/>

<!-- composite attributes -->
<attribute name="Usage:used" outputname="usageUsed"/>
<attribute name="Usage:max" outputname="usageMax"/>
<attribute name="Usage:committed" outputname="usageCommitted"/>
<attribute name="Usage:init" outputname="usageInit"/>

</mbean>

<mbean domain="java.lang" properties="type=GarbageCollector,name=*">

<!-- simple array attributes -->   <attribute name="Name" outputname="gcName"/>
<attribute name="MemoryPoolNames" outputname="memPools"/>

<!-- simple attributes -->
<attribute name="CollectionTime" outputname="colTime"/>
<attribute name="CollectionCount" outputname="colCount"/>

<!-- composite-simple attributes -->
<attribute name="LastGcInfo:startTime" outputname="gCStart"/>
<attribute name="LastGcInfo:endTime" outputname="gCEnd"/>
<attribute name="LastGcInfo:id" outputname="gCID"/>
<attribute name="LastGcInfo:duration" outputname="gCDuration"/>
<attribute name="LastGcInfo:GcThreadCount" outputname="gCThreadCount"/>

</mbean>

Predefined_IBM_WAS_Performance_Template contains MBean configurations specific to IBM Websphere Application Server (WAS) that instruct the Splunk Add-on for Java Management Extensions to pull data with all the available attributes of the selected Mbeans. These are used to measure the performance of the applications.

<mbean domain="WebSphere" properties="*,type=JDBCProvider,j2eeType=JDBCResource" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=DataSource,j2eeType=JDBCDataSource" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=JVM,j2eeType=JVM" dumpAllAttributes="true" ></mbean>   <mbean domain="WebSphere" properties="*,type=J2CResourceAdapter,j2eeType=JCAResource" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=SessionManager" dumpAllAttributes="true" ></mbean>   <mbean domain="WebSphere" properties="*,type=SystemMetrics" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=ThreadPool" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=TransactionService,j2eeType=JTAResource" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=Servlet,j2eeType=Servlet" dumpAllAttributes="true" ></mbean>
<mbean domain="WebSphere" properties="*,type=JSP" dumpAllAttributes="true" ></mbean>

Configure inputs

A data input is mapped to a task, defined by a set of servers and templates. The add-on polls the selected servers for the data described in the selected templates.

To create a new input, follow these steps.

  1. Click on Inputs tab to access the input configuration screen.
  2. Click on Create New Input to create a new input.
  3. Keep the default Destination App to associate the input with the Splunk Add-on for JMX.
  4. Give the input a Name and a Description to differentiate it from other inputs that you may create.
  5. On the Servers tab, select one or more servers that this input should access for data.
  6. On the Templates tab, select one or more templates that describe the data you want to access.
  7. On the Settings tab, you can adjust the Polling Interval (in seconds), Source Type, and Index, if you wish to change the defaults. The default polling interval is 60 seconds. Note that an interval configured at the server level overrides this input-level configuration for that specific server.
  8. Click Create. The Splunk Add-on for JMX creates the input and enables it by default. To disable the input at any time, click Disable in the row for that input.

Note

Only a single server of ‘’Connection Type’’ IBMsoap can be selected per task as separate property files (soap.client.props and ssl.client.props) are required to connect to a single IBM WAS server. Multiple inputs must be configured to collect data from multiple servers.

Once you have configured your tasks, your inputs are enabled and polling your JMX servers according to the intervals you configured. If you do not see data from your JMX servers in your Splunk Enterprise instance, see the Troubleshooting page.

Configure inputs for the Splunk Add-on for JMX using .conf files

You can configure inputs manually by configuring jmx_tasks.conf file.

Create a stanza in jmx_tasks.conf

  1. In your Splunk platform instance, navigate to $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/local.
  2. Create a jmx_tasks.conf file, if it does not already exist.
  3. Open the jmx_tasks.conf file in a text editor.

  4. In a text editor, edit the jmx_tasks.conf file to create a task. See the following example:

    [test_task]
description = Test Task
destinationapp = Splunk_TA_jmx
index = default   interval = 60
servers = Splunk_TA_jmx:server1 | Splunk_TA_jmx:server2
sourcetype = jmx
templates = Splunk_TA_jmx:test | Splunk_TA_ibm-was:WebSphere_AB_AlarmManager_Attributes

  5. This input is enabled by default. In order to disable it, add a disabled = 1 line to the bottom of the stanza.

  6. Adjust or add other arguments as needed. See the guidelines in the following table for reference:

    Argument Description
    description The description for the configured stanza. It may contain any free-form string and is provided for the convenience and readability of the user.
    destinationapp The name of the app where this stanza is configured. Keep its value as Splunk_TA_jmx.
    index The index to use for events collected through this add-on. Add this argument to specify a non-default index. The default index is main.
    interval How long Splunk Enterprise waits before collecting data again, in seconds. Note that an interval configured at the server level overrides this input-level configuration for that specific server.
    servers Enter the name of the servers from which the data should be collected in the format <destinationapp>:<server_name>, where destinationapp is the Destination App parameter and server_name is the Name parameter of the configured server. As shown in the sample above, multiple servers should be separated by pipe symbol. Note: If the Connection Type parameter of the server is IBMsoap, only a single server should be entered per stanza as separate property files (soap.client.props and ssl.client.props) are required to make connection to a single IBM WAS server. Multiple inputs will have to be configured to collect data from multiple servers.
    sourcetype The source type to use for events collected through this add-on. The default is jmx.
    templates Enter the name of the templates to define the Mbeans from which the data should be collected in the format <destinationapp>:<template_name>, where destinationapp is the Destination App parameter and template_name is the Name parameter of the configured template. As shown in the sample above, multiple templates should be separated by pipe symbol.

    Note

    The name for every stanza must be unique.

  7. Save your changes.

  8. Once the stanza is configured with accurate information, a corresponding stanza is created in inputs.conf, along with the configuration XML file, and the modular input will start to collect data.

Enable or disable storing configuration in another add-on

By default, this add-on is configured to store configuration in another add-on. To disable this feature — which hides the Destination App selection box on the input, servers and template pages in Splunk Web — complete this step:

  • In your local splunk_ta_jmx_settings.conf file, set the display_destination_app setting to 0.

MBean configuration XML reference

Object name reference

For MBean definitions, standard JMX object name wildcard patterns * and ? are supported for the domain and properties attributes. See the Oracle documentation for more information.

If no values are specified for the domain and properties attributes, the value defaults to the * wildcard.

The add-on’s modular input writes out the MBean’s canonical object name to Splunk Enterprise.

Attribute polling reference

You can set the dumpAllAttributes value to true to extract all of an MBean’s Attributes.

For example, to extract all the Attributes in the java.lang domain:

mbean domain="java.lang" properties="*" dumpAllAttributes="true"

For example, to extract all the attributes in all of the cassandra domains:

mbean domain="org.apache.cassandra." properties="" dumpAllAttributes="true"

Or, you can specify each individual attribute you want to extract using the attribute element.

For Attributes that are multi-level (composite and tabular Attributes) use “:” delimited notation for specifying the Attribute name. See examples of this in the config.xml included in $SPLUNK_HOME/apps/Splunk_TA_jmx/bin/config/examples.

Operation invocation reference

The add-on supports MBean Operation invocation. You can declare Operations that return a result or not, or that take arguments or not, and index the return value. Operation overloading is supported for methods of the same name with different signatures.

The following parameter types are supported :

  • int
  • float
  • double
  • long
  • short
  • byte
  • boolean
  • char
  • string

Internally these get autoboxed into their respective Object counterparts.

See config_operations_example.xml in $SPLUNK_HOME/apps/Splunk_TA_jmx/bin/config/examples for usage scenarios.

MBean notification reference

MBean notification listening is supported simply by adding a notificationListener element as a child of any MBean.

See config_notifications.xml in $SPLUNK_HOME/apps/Splunk_TA_jmx/bin/config/examples for an example configuration.

Supported return data types for operations and attributes

Single, composite, and tabular MBean Attributes are supported.

The value obtained from the Attribute or as the return type of an Operation can be:

Any primitive type (object-wrapped):

  • String
  • Array
  • List
  • Map
  • Set

Collection types are recursively deeply inspected, so you can have Collections of Collections, and so on.

Ended: Configuration

Troubleshooting ↵

Troubleshoot the Splunk Add-on for JMX

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Log files

Most runtime errors are written to $SPLUNK_HOME/var/log/splunk/jmx.log. Some errors can be found in $SPLUNK_HOME/var/log/splunk/splunkd.log.

You can customize the log4j settings by changing the contents in $SPLUNK_HOME/etc/apps/Splunk_TA_jmx/bin/lib/log4j.xml.

Warning messages if provided configuration might result in data duplication

The following error message appears in the ta_jmx_rh_input_data_duplication.log file when you use a server and template pair that another input is already using:

2019-03-13 16:19:01,767 WARNING pid=7704 tid=MainThread file=splunk_ta_jmx_utility.py:check_data_duplication:76 | Selected templates: [<List_of_Templates>] and servers: [<List_of_Servers>] are already present in enabled stanza: <Input_Name>. This may cause data duplication

JMX Server credential validation

The following error can be observed in UI for one of the following cases:

  • The JMX is not enabled on a Java machine.
  • You create the server with invalid server credentials.
  • Your Splunk platform deployment is not able to reach the service where JMX is running.

Failed to make connection with JMX server. Please ensure correct values are entered.

Third-party library warning logger messages

A third-party library initiates an error message when the Java modular input initializes. You can ignore this warning message, or upgrade Add-on to 5.6.0 or higher to stop seeing this warning:

org.exolab.castor.mapping.Mapping loadMapping

Missing jmx_tasks error logger messages

The following error appears in splunkd.log when you first install the add-on, initially there are no tasks configured. Once the Add-on is configured for data collection, this error no longer appears:

ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_jmx/bin/jmx.py" ConfManagerException: Config file: jmx_tasks does not exist.

OutOfMemory Error messages in logs

An OutOfMemory Error in splunkd.log files when using the IBM java is thrown when the Java Virtual Machine cannot allocate an object because it is out of memory and no more memory could be made available by the garbage collector. Increase the heap size to resolve this issue:

  1. Navigate to $SPLUNK_HOME$/etc/apps/Splunk_TA_jmx/bin/java_const.py

  2. Change the code from:

    JAVA_COMMON_ARGS = [JAVA_EXECUTABLE ,"-classpath", CLASSPATH, "-Dconfighome=" + CONFIG_HOME,"-Dsplunkhome="+ SPLUNK_HOME]

    to

    JAVA_COMMON_ARGS = [JAVA_EXECUTABLE, "-Xmx<maxheapsize>m" ,"-classpath", CLASSPATH, "-Dconfighome=" + CONFIG_HOME,"-Dsplunkhome="+ SPLUNK_HOME]

  3. Replace the with a suitable Maximum heap size value in Megabytes (m denotes Megabytes). Do not allocate more memory to heap than the available physical memory on the machine.

  4. Restart Splunk.

UnknownHost Exception logged in jmx.log

The following error might appear when you configure a new server:

com.splunk.jmx.ServerConfigValidator -22697 [P=70438:O=0:CT] ERROR [] - Failed to make connection with JMX server. Reason- defaultLocalHost:java.net.UnknownHostException: ibmwebsphere: ibmwebsphere: System error   org.omg.CORBA.INTERNAL: defaultLocalHost:java.net.UnknownHostException: ibmwebsphere: ibmwebsphere: System error
at com.ibm.rmi.corba.ORB.defaultLocalHost(ORB.java:2041) ~[?:?]
at com.ibm.rmi.corba.ORB.defaultBootstrapHost(ORB.java:2018) ~[?:?]
at com.ibm.rmi.corba.ORB.parseProperties(ORB.java:2146) ~[?:?]
at com.ibm.rmi.corba.ORB.orbParameters(ORB.java:1347) ~[?:?]
at com.ibm.rmi.corba.ORB.set_parameters(ORB.java:1295) ~[?:?]
at com.ibm.CORBA.iiop.ORB.set_parameters(ORB.java:1695) ~[?:?]
at org.omg.CORBA.ORB.init(ORB.java:401) ~[?:?]
at [jmxmodinput.jar:?]

The issue can be resolved if you add the server host to the list of the hosts in the machine where your Splunk platform instance is configured for data collection:

  1. For Linux systems, the host file is present at the following path: /etc/hosts
  2. For Windows systems, the host file is usually present at the following path: C:\Windows\System32\drivers\etc\hosts

  3. Navigate to the host file and add the following line to add the host of the server:

    <host_ip> <host_name>

  4. Save your changes.

Ended: Troubleshooting

Reference ↵

Source types for the Splunk Add-on for JMX

This add-on provides the index-time and search-time knowledge for MBean attributes, operations, and notifications. All events ingested by this add-on are sourcetype=jmx.

This source type supports the JVM Common Information Model data model.

Ended: Reference