topic Re: splunk ingestion from queues in All Apps and Add-ons

splunk ingestion from queues

ankithreddy777 — Wed, 18 Jul 2018 19:08:59 GMT

I am using Splunk heavy forwarder to read data from the MQ/Solace queues. For this I am using app "Splunk JMS modular input".

But when the data read from queues is indexed, It is converting the new lines in the message to series of white spaces. i.e. it is simply converting multi line event to single line event. May I know how to handle this scenario without parsing the events further.

Ex:
Actual event:
how are you
hi
good to know

Indexed event:
how are you hi good to know

Re: splunk ingestion from queues

Damien_Dallimor — Thu, 19 Jul 2018 00:13:11 GMT

Have you tried unchecking that default option.

Re: splunk ingestion from queues

ankithreddy777 — Tue, 29 Sep 2020 20:33:22 GMT

Hi Damien,
Thank you for the response. Is it possible to remove the header for every message which is added by splunk JMS when read the message from queue.

Example.
Thu Jul 19 13:10:13 CDT 2018 name=QUEUE_msg_received event_id=ID:xxxxx msg_dest=xxx msg_body=

Re: splunk ingestion from queues

Damien_Dallimor — Thu, 19 Jul 2018 20:27:00 GMT

https://answers.splunk.com/answers/671924/get-only-the-message-body-from-jms-messaging-modul.html

Re: splunk ingestion from queues

ankithreddy777 — Thu, 19 Jul 2018 20:50:52 GMT

thank you

Re: splunk ingestion from queues

ankithreddy777 — Tue, 28 Aug 2018 14:44:37 GMT

@Damien Dallimore , Splunk JMS app UI is basically showing to enter connection details for connecting solace queues. In case if I have to connect to MQ queue(where wee have host, serverchannel etc), May I know how to enter the values on UI. I tried to enter key value pairs in JNDI properties input box, but it is not working.

It would be a great help.

Re: splunk ingestion from queues

Damien_Dallimor — Wed, 29 Aug 2018 01:31:05 GMT

No , the JMS configuration page provides fields for connecting to ANY JMS provider. It is not specific to any particular JMS provider (such as Solace).

Maybe this blog will help you : https://www.splunk.com/blog/2013/04/11/splunking-websphere-mq-queues-and-topics.html

Re: splunk ingestion from queues

ankithreddy777 — Wed, 29 Aug 2018 19:36:05 GMT

Hi @Damien Dallimore , Instead of using bindings file for MQ setup,

Can we provide property values like host name, serverchannel, queuemanager to connect to queue via JMS UI.

Re: splunk ingestion from queues

Damien_Dallimor — Wed, 29 Aug 2018 21:07:40 GMT

Yes. This is very clearly and thoroughly described in : https://www.splunk.com/blog/2013/04/11/splunking-websphere-mq-queues-and-topics.html , have you tried reading the blog and trying it out for yourself yet ?

Re: splunk ingestion from queues

ankith_nt — Wed, 29 Aug 2018 21:25:32 GMT

Hi Damien, the blog explains to create a binding file to connect to MQ. But it does not explain , how to connect without the binding file. Sorry, If I am missing something from the blog that I need to consider. Basically I dont have binding file and looking for options to create connection without bindings file

Re: splunk ingestion from queues

Damien_Dallimor — Thu, 30 Aug 2018 01:49:28 GMT

The JMS App requires that the JMS objects are registered in a JNDI namespace (ldap, file etc..) and looked up by way of your configuration, rather than by building the JMS objects locally by way of setting properties at runtime.

This is because the JMS App does not use provider specific classes (such as MQ classes) , the code is asbstracted at the JMS interface level which allows the app to work with any JMS Provider.