All Apps and Add-ons

How to only get the message body from JMS Messaging Modular Input?

New Member

Hello,
I started using JMS Messaging Modular Input. I send a message to a jms queue that have the body: key1="a" key2="b".
The JMS Messaging Modular Input generate a splunk event that looks like:
Sun JUL 15 10:545:44 2018 name=QUEUEmsgreceived eventid=ID:<...> msgdest=jms/splunk/test msg_body=key1="a" key2="b".
I want that the splunk event will have only the msg_body value (i.e: key1="a" key2="b") and not the other things, any ideas how to configure it?
the "Index messaged header field" checkbox is UNCHECKED.

thanks,
Ronen

0 Karma
1 Solution

Ultra Champion

Declare a built in custom message handler , com.splunk.modinput.jms.custom.handler.BodyOnlyMessageHandler

alt text

View solution in original post

0 Karma

Ultra Champion

Declare a built in custom message handler , com.splunk.modinput.jms.custom.handler.BodyOnlyMessageHandler

alt text

View solution in original post

0 Karma