I'm using the JMS modular input to read IBM MQ messages from a queue.
The majority of the messages are read correctly, but if there is a message with a blank 'Data Format' in the RFH2 header, the message is placed to the back out queue with the exception in splunkd.log:
/splunk/etc/apps/jms_ta/bin/jms.py" Examine the message data and ensure that it is of the correct format to be parsed as an MQJMS Message.
Of course I can look to amend the source system so that the data format is set, but is there anyway within Splunk I can force a default format like MQSTR?
This error is thrown by the underlying WAS MQ JMS provider jars.
So it is not something addressable in the JMS Modular Input code or Splunk.
It appears a non-JMS / non-parseable message was placed on the queue.
More info on this error , code JMSCMQ0018
View solution in original post