JMS Modular input data corruption

[pcressy]

Implemented JMS to read a Websphere MQ. The message text is coming in corrupted. I can read the field name fine but the message body is mostly "?" (example: msg_body="?????????????????). Looking at the data still inside the queue looks ok. I've tried some different settings in props.conf using the variable CHARSET=utf-8 with no change that I can see.

[pcressy]

The data was being sent ASCII but with a CCID of 037 (EBCDIC), so MQ was trying to convert to ASCII. Once the CCID was corrected it worked, this was all done on the vendor and MQ side, nothing with splunk was changed.

[pcressy]

The vendor sending the data has already converted it to ASCII, is it possible that jms is trying to convert ascii to ascii because it believes its in EPCDIC. What settings control what JMS is expecting.

[Damien_Dallimor]

The JMS Mod Input will process ASCII encoded payloads perfectly.

If you are saying that "The vendor sending the data has already converted it to ASCII" , then perhaps the issue is at the message producer side of the equation not correctly encoding ASCII.

If you are trying to send EBCDIC through , you would need to write a custom message handler (as technically this is binary content that needs decoding).

[pcressy]

The message is 3143 characters with predefined length. Here is some of the data that was pulled directly out of the queue.

20141028164938908415 01001H5#0$AWAUT TQW388IC26 TS2 Y 756026400229729162

[Damien_Dallimor]

Please elaborate on "character". Charsets , Encodings etc.....

Please give me an example of the correctly formatted expected message body that is being output as ??????????

[Damien_Dallimor]

Can you please describe the format, structure and encoding of what the actual message payload is. Examples help also.