I'm trying to setup JMS modular input with Websphere MQ, and went through the steps described in this blog post http://blogs.splunk.com/2013/04/11/splunking-websphere-mq-queues-and-topics/ but its it is not working for me, and I'm not sure where to start with the diagnosis, here is the logs from splunkd:
07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py" at javax.naming.InitialContext.lookup(Unknown Source)
07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py" at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)
07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py" at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)
07-11-2014 17:37:48.594 +1000 ERROR ExecProcessor - message from "python D:\Splunk\etc\apps\jms_ta\bin\jms.py" at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)
Any hints?
Thanks in advance for your help.
The above log snippet is not entirely descriptive , ergo , guessing somewhat here :
Have you created your FSContext file correctly ?
Is the path to the FSContext file correctly specified in your JMS stanza ?
Are your JNDI names in your JMS stanza correct as per what was setup in the FSContext your MQ admin created ?
I probably should also note that I'm running the free Splunk (not free trial) version, and I was not able to add the JMS stanza from the web due to a weird license error, so I added this manually in the inputs.conf file, does it make a difference?
Thanks.
I created the FSContext file correctly and the path is correct, the whole setup is on my local test machine, here is my JMS stanza:
[jms://queue/splunkqueue]
browse_mode = all
browse_queue_only = 1
durable = 0
index = jms
index_message_header = 1
index_message_properties = 1
init_mode = jndi
jms_connection_factory_name = SplunkConnectionFactory
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:/D:/temp/
sourcetype = mq
strip_newlines = 1
browse_frequency = -1
disabled = 1
Happened to notice that in the stanza above, you have disabled=1, meaning that splunk should ignore the whole stanza.
Right this should be modified
Right this should be modified