Configure dumpAllThreads inputs for the Splunk Add-on for Tomcat¶

After you have set up the Splunk Add-on for Tomcat, validate that the correct inputs have been created. You need to update and activate the dumpAllThreads input to collect thread information from your Tomcat servers. You can activate the input either through Splunk Web or through the configuration files.

The file monitoring inputs for the local Tomcat logs are activated by default, but it is a good idea to confirm that they have been created.

Configure Tomcat inputs using Splunk web¶

In the Splunk Add-on for Tomcat, click the Inputs tab.
Click Create New Input.

In the Add Input box, complete the following fields:

Field	Description
Name	Enter a unique name for the input.
Tomcat Account	Select your Tomcat account name configured under the Configurations page.
Collection Interval	The data collection interval, in seconds.
Index	The index that stores the collected data from this input. The default index is main.

Click Save.

Configure Tomcat inputs using inputs.conf¶

To configure inputs manually in inputs.conf, create stanzas using the following parameters and add them to $SPLUNK_HOME/etc/apps/Splunk_TA_tomcat/local/inputs.conf. If the file or path does not exist, create it.

[tomcat://<name>]
account = <string>
object_name = java.lang:type=Threading
operation_name = dumpAllThreads
signature = boolean, boolean
params = true, true
split_array = true
duration = <integer>

If you want to use the default inputs, the default value of the inputs can be found in $SPLUNK_HOME/etc/apps/Splunk_TA_tomcat/default/inputs.conf. You can copy the file to the local folder and edit it using the parameters in the following table.

Input parameters¶

Each attribute in the following table corresponds to a field in Splunk Web:

Attribute	Corresponding field in Splunk Web	Description
`account`	Tomcat Account	Account from which data is to be collected.
`object_name`	ObjectName	The object name of the MBean on which the method is to be invoked. Supported is `java.lang:type=Threading`
`operation_name`	OperationName	The name of the operation to be invoked. Supported is `dumpAllThreads`
`signature`	Signature	Enter the java data types separated by comma. Supported is `boolean, boolean`
`params`	Parameters	Enter the values for the data types(entered in Signature) separated by comma. Supported is `true, true`
`split_array`	SplitArray	False] True to split up the whole data chunk into events and false if otherwise. Supported is `true`
`duration`	Collection Interval	Collection interval at which the data should be collected.
`index`	Index	The index in which to store Tomcat input data. The default is default.

Validate file monitoring inputs¶

Validate that file monitoring inputs have been successfully created.

Go to Settings > Data inputs > Files & directories.
Select App in the column headings to organize the results by app name, then scroll to Splunk_TA_tomcat in that column.
Review the list of files being monitored to ensure it is as you expect. They should be activated by default.

Note

If you subsequently change the directory in which the log files are stored, generate new file monitoring inputs for the new location by using Settings > Data inputs > Files & directories page or update the local copy of inputs.conf file.

Validate data collection¶

To verify the add-on has been installed successfully and that all expected data is being ingested into the Splunk platform, run the following searches depending on which inputs you have configured.

Performance data and thread information:
```
sourcetype=tomcat:jmx
```
catalina\*.log, localhost\*.log, manager\*.log, and host-manager\*.log:
```
sourcetype=tomcat:runtime:log
```
locahost\_access\_log\*.txt:
```
sourcetype=tomcat:access:log
```
locahost\_access\_log\_splunk\*.txt:
```
sourcetype=tomcat:access:log:splunk
```