JMS Messaging Modular Input: How to configure the app and index messages from my service bus in azure?

[shayfa]

Hey,
I am trying to use your splunk-app called "JMS Messaging Modular Input"
so till now i only entered the JMS Connection Factory JNDI Name but the data is not being indexed.
the splunk logs shows the following:

01-20-2015 11:57:59.909 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Stanza jms://queue/ClientLogs:clientlogs : Error connecting : javax.naming.NoInitialContextException: Cannot instantiate class:  [Root exception is java.lang.ClassNotFoundException: ]

01-20-2015 11:57:59.910 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)

01-20-2015 11:57:59.910 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)

01-20-2015 11:57:59.910 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.init(Unknown Source)

01-20-2015 11:57:59.910 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at javax.naming.InitialContext.(Unknown Source)

01-20-2015 11:57:59.910 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)

01-20-2015 11:57:59.910 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

01-20-2015 11:57:59.911 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py" Caused by: java.lang.ClassNotFoundException:

01-20-2015 11:57:59.911 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.lang.Class.forName0(Native Method)

01-20-2015 11:57:59.911 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at java.lang.Class.forName(Unknown Source)

01-20-2015 11:57:59.911 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        at com.sun.naming.internal.VersionHelper12.loadClass(Unknown Source)

01-20-2015 11:57:59.911 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/jms_ta/bin/jms.py"        ... 6 more

When I read this error, i understand that the "JNDI Initial Context Factory Name" is the missing thing, but i have no idea what I should write there. I searched for explanations through the web, but didn't a successful way to configure it and make it work.

It will be really appreciated if you can assist me somehow.
Thanks !

[Damien_Dallimor · Accepted solution]

I have not used Azure Service Bus , but I am reasonably adept at following documentation , so lets give this a go.

Based on this : http://azure.microsoft.com/en-us/documentation/articles/service-bus-java-how-to-use-jms-api-amqp/

Step 1

Obtain these 4 jar files and place them in SPLUNK_HOME/etc/apps/jms_ta/bin/lib.The Azure doc mentions where to obtain them.

geronimo-jms_1.1_spec-1.0.jar
qpid-amqp-1-0-client-[version].jar
qpid-amqp-1-0-client-jms-[version].jar
qpid-amqp-1-0-common-[version].jar

Step 2

Create a properties file-based JNDI Provider for Azure. Call the file servicebus.properties and save it somewhere on your filesystem.

File contents. Replace the "[your_*]" items as per the Azure documentation

# servicebus.properties - shayfa's JNDI configuration
connectionfactory.MY_SBCF = amqps://[your_username]:[your_urlencoded_password]@[your_namespace].servicebus.windows.net

# Register your queue in JNDI
queue.MY_QUEUE = [your_queue_name]

Step 3

Now you are ready to setup your JMS stanza in Splunk.

The core connection settings might look something like this :

[shayfa]

OK it works !
Thanks you

[Damien_Dallimor]

First off all , for folks to help out in the best manner possible , you need to more accurately describe your use case.

What Messaging platform are you trying to connect to ?
What OS , version of Splunk , version of the JMS Mod Input ?
What steps have you performed to setup the JMS Mod Input stanza , copy over any dependent jar files etc.. ?
Have you followed all the steps in the trouble shooting guide in the docs : https://apps.splunk.com/app/1317/#/documentation ?

Also , you are going to struggle if you don't have basic Java skills , familiarity with basic java and JMS concepts.Is there a developer or admin on your team who is familiar with java/jms to help expedite your setup ?

[shayfa]

Hi ,
The massaging platform is a queue in the service bus in azure cloud platform.
i have a queue which i want to index the data inside it.
the splunk is version 6.1 ans being installed on linux server Ubuntu 12.04.2 LTS.
The JMS i'v installed is from the link below: https://apps.splunk.com/app/1317/#/overview
that's 1.3.7.
in order to use the app i used to follow the link below: http://azure.microsoft.com/en-us/documentation/articles/service-bus-java-how-to-use-jms-api-amqp/ and build just the ConnectionURL
also added the jars described there.