Splunk® IT Service Intelligence

Modules

This documentation does not apply to the most recent version of Splunk® IT Service Intelligence. For documentation on the most recent version, go to the latest release.

Application Server Module configurations

Follow the below steps to configure your ITSI deployment to receive application server data.

Module entity roles

See the below table to identify the roles that the Application Server Module assigns to entities:

ITSI Module ITSI Role
ITSI Application Server Module application_server

Step 1: Install supported technologies

See About installing Splunk add-ons to learn how to install a Splunk add-on in the following deployment scenarios.

Install your ITSI supported technologies onto your deployment using the reference table below. For single instance deployments, install supported technologies onto your single instance.

Technology Name Installation link Search Heads Indexers Heavy Forwarders
Splunk Add-on for Tomcat Installation guide x x x
Splunk Add-on for IBM WebSphere Application Server Installation guide x x x

Configure the Splunk Add-on for IBM WebSphere Application Server to send WebSphere Applications Server data to your Splunk platform deployment. See the Splunk Add-on for IBM WebSphere Application Server configuration section for more information.

Configure the Splunk Add-on for Tomcat to collect and send local and remote Tomcat server data to your Splunk platform deployment. See the Splunk Add-on for Tomcat configuration section for more information.

Step 2: Install and configure the Splunk Add-on for Java Management Extensions (JMX) to collect and send data to your Splunk platform

Java Management Extension environments

The Application Server Module uses the Splunk Add-on for Java Management Extensions (JMX) to poll local or remote JMX Management Servers running in Java Virtual Machines and index MBean attributes, outputs from MBean operations, and MBean notifications.

Install the JMX add-on on the servers where your data is ingested. See the deployment tables below for add-on deployment information. See the Splunk Add-on for Java Management Extensions (JMX) installation and configuration documentation guides for more information.

Step 3: Build necessary lookups for correlating data

In order to correlate data between app server logs and JMX metrics, lookups are required. The process for configuring lookups for both Tomcat and Websphere Add-ons are below.

Enable Tomcat searches for building lookups

See the Splunk Add-on for Tomcat documentation for data collection enablement. The saved searches required to build the necessary lookups are disabled by default. To enable them go to Settings > Searches, Reports and Alerts and select Splunk Add-on for Tomcat for the App Context. These searches will run every 4 hours. To retrieve results immediately, manually run the following saved searches:

  1. Tomcat version number
  2. Tomcat application server

Tomcatlookups.png


Enable Websphere searches for building lookups

See the Splunk Add-on for IBM WebSphere Application Server documentation for data collection enablement. The saved searches required to build the necessary lookups are disabled by default, to enable them go to Settings > Searches, Reports and Alerts and select Splunk Add-on for IBM WebSphere for the App Context. These searches will run every 4 hours, to retrieve results immediately manually run the following search:

"Server Index - WAS Inventory Lookup"

Webspherelookup.png

Step 4: Enable entity discovery

Enable entity discovery for the module to automatically discover entities for which relevant data has been collected. See Enable the automatic entity discovery search.

Last modified on 28 April, 2023
About the Application Server Module   Application Server Module KPIs and thresholds

This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.11.0, 4.11.1, 4.11.2, 4.11.3, 4.11.4, 4.11.5, 4.11.6, 4.12.0 Cloud only, 4.12.1 Cloud only, 4.12.2 Cloud only, 4.13.0, 4.13.1, 4.13.2, 4.13.3, 4.14.0 Cloud only, 4.14.1 Cloud only, 4.14.2 Cloud only, 4.15.0, 4.15.1, 4.15.2, 4.15.3, 4.16.0 Cloud only, 4.17.0, 4.17.1, 4.18.0, 4.18.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters