All Apps and Add-ons

JMS Modular input data corruption

pcressy
Engager

Implemented JMS to read a Websphere MQ. The message text is coming in corrupted. I can read the field name fine but the message body is mostly "?" (example: msg_body="?????????????????). Looking at the data still inside the queue looks ok. I've tried some different settings in props.conf using the variable CHARSET=utf-8 with no change that I can see.

0 Karma

pcressy
Engager

The data was being sent ASCII but with a CCID of 037 (EBCDIC), so MQ was trying to convert to ASCII. Once the CCID was corrected it worked, this was all done on the vendor and MQ side, nothing with splunk was changed.

0 Karma

pcressy
Engager

The vendor sending the data has already converted it to ASCII, is it possible that jms is trying to convert ascii to ascii because it believes its in EPCDIC. What settings control what JMS is expecting.

0 Karma

Damien_Dallimor
Ultra Champion

The JMS Mod Input will process ASCII encoded payloads perfectly.

If you are saying that "The vendor sending the data has already converted it to ASCII" , then perhaps the issue is at the message producer side of the equation not correctly encoding ASCII.

If you are trying to send EBCDIC through , you would need to write a custom message handler (as technically this is binary content that needs decoding).

0 Karma

pcressy
Engager

The message is 3143 characters with predefined length. Here is some of the data that was pulled directly out of the queue.

20141028164938908415 01001H5#0$AWAUT TQW388IC26 TS2 Y 756026400229729162

0 Karma

Damien_Dallimor
Ultra Champion

Please elaborate on "character". Charsets , Encodings etc.....

Please give me an example of the correctly formatted expected message body that is being output as ??????????

0 Karma

Damien_Dallimor
Ultra Champion

Can you please describe the format, structure and encoding of what the actual message payload is. Examples help also.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...