Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: JMS Modular input data corruption
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
JMS Modular input data corruption
Implemented JMS to read a Websphere MQ. The message text is coming in corrupted. I can read the field name fine but the message body is mostly "?" (example: msg_body="?????????????????). Looking at the data still inside the queue looks ok. I've tried some different settings in props.conf using the variable CHARSET=utf-8 with no change that I can see.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data was being sent ASCII but with a CCID of 037 (EBCDIC), so MQ was trying to convert to ASCII. Once the CCID was corrected it worked, this was all done on the vendor and MQ side, nothing with splunk was changed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The vendor sending the data has already converted it to ASCII, is it possible that jms is trying to convert ascii to ascii because it believes its in EPCDIC. What settings control what JMS is expecting.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The JMS Mod Input will process ASCII encoded payloads perfectly.
If you are saying that "The vendor sending the data has already converted it to ASCII" , then perhaps the issue is at the message producer side of the equation not correctly encoding ASCII.
If you are trying to send EBCDIC through , you would need to write a custom message handler (as technically this is binary content that needs decoding).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The message is 3143 characters with predefined length. Here is some of the data that was pulled directly out of the queue.
20141028164938908415 01001H5#0$AWAUT TQW388IC26 TS2 Y 756026400229729162
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please elaborate on "character". Charsets , Encodings etc.....
Please give me an example of the correctly formatted expected message body that is being output as ??????????
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please describe the format, structure and encoding of what the actual message payload is. Examples help also.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
