JMS Messaging Modular Input: How to automatically run xmlkv?

[David]

I am using the JMS Mod Input. The mod input outputs the timestamp, eventid, and then a msg_body="[Giant XML Blob]". If I run in search and use |xmlkv, it nicely pulls out the xml fields from the middle of that event, but that doesn't work if I set kv_mode=XML (I think) because the entire event isn't XML.

I can't seem to find a way to have xmlkv automatically run, though. Has anyone dealt with this before?

[Damien_Dallimor]

Fast Forward 2 years......November 2016 update....

In the latest version of the code , you should use com.splunk.modinput.jms.custom.handler.BodyOnlyMessageHandler , this is built in with the core release , so you don't need to do anything other than declaring this handler to be applied in your JMS stanza.

https://github.com/damiendallimore/SplunkModularInputsJavaFramework/blob/master/jms/src/com/splunk/m...

[rahlers_splunk]

You can also strip it down to just the JSON or XML message this way:
http://answers.splunk.com/answers/201739/how-to-get-a-sourcetype-of-json-mixed-with-text-th.html

If it is XML, add the following to you props.conf

SEDCMD-stripnonxml-1=s/^.*msg_body="//
SEDCMD-stripnonxml-2=s/\"$//

[Damien_Dallimor]

The 'xml' and 'json' modes will not extract any fields when used on data that isn't of the  correct format (JSON or XML)

So , if you want to use KV_MODE in props.conf , the indexed event has to be just the XML payload.

You can plug in a custom message handler to the JMS Modular Input that will index only the XML message payload.

Here is some code : https://gist.github.com/damiendallimore/eef6434b8daec578c42a

1) compile this code and add the class file to a jar file
2) place this jar file in SPLUNK_HOME/etc/apps/jms_ta/bin/lib
3) in your JMS stanza , declare this custom handler to be used