JMS Modular Input and Websphere MQ

[laithmurad]

I'm trying to setup JMS modular input with Websphere MQ, and went through the steps described in this blog post http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/ but its it is not working for me, and I'm not sure where to start with the diagnosis, here is the logs from splunkd:

07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py"  at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py"  at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)

07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py"  at javax.naming.InitialContext.lookup(Unknown Source)

07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py"  at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)

07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py"  at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)

07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py"  at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)

Any hints?

Thanks in advance for your help.

[Damien_Dallimor]

The above log snippet is not entirely descriptive , ergo , guessing somewhat here :

Have you created your FSContext file correctly ?

Is the path to the FSContext file correctly specified in your JMS stanza ?

Are your JNDI names in your JMS stanza correct as per what was setup in the FSContext your MQ admin created ?

[laithmurad]

I probably should also note that I'm running the free Splunk (not free trial) version, and I was not able to add the JMS stanza from the web due to a weird license error, so I added this manually in the inputs.conf file, does it make a difference?

Thanks.

[laithmurad]

I created the FSContext file correctly and the path is correct, the whole setup is on my local test machine, here is my JMS stanza:

[jms://queue/splunkqueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = SplunkConnectionFactory
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/D:/temp/
sourcetype = mq
strip_newlines = 1
browse_frequency = -1
disabled = 1

[sideview]

Happened to notice that in the stanza above, you have disabled=1, meaning that splunk should ignore the whole stanza.

[arunsundaram]

Right this should be modified

[arunsundaram]

Right this should be modified