Using Splunk to collect data from disparate sources is remarkably easy; but sometimes, making those sources emit data can take a bit more effort. Here’s some quick notes on making IBM WebSphere Application Server speak Java Management Extensions so that the Splunk Add-on for Java Management Extensions and Splunk Add-on for IBM WebSphere Application Server can be used to gather data. This isn’t comprehensive documentation for all possible scenarios, but rather some notes that we gathered in the development process.
Of course, the first step is to log on to the WebSphere Admin Console. Use the menu on the left to navigate to Servers -> Server Types -> WebSphere Application Servers. Click on the Application Server instance that you want to configure (server1 in this example screenshot).
That will take you to an administration page for the server. Select the Configuration tab, and then scroll down to Server Infrastructure. Click the plus sign to expand the Administration section, and select Administration Services.
Now, select JMX Connectors…
…and enable the JSR160 RMI JMX Connector.
Next, take note of the IIOP Port Number. Go back to the administration page for this server, select the Configuration tab, and then scroll down to Server Infrastructure. Click the plus sign to expand the Ports section, and check the ORB_LISTENER_ADDRESS value. This port will be used for JMX client connections, and should be the same as the IIOP Port Number. The default value is 9100.
I hope this helps! Be sure to read through the Add-on documentation for Splunk Add-on for Java Management Extensions and Splunk Add-on for IBM WebSphere Application Server as well, there’s a lot of useful information in there.