JMS modular input - MQ data format

[julietjake]

I'm using the JMS modular input to read IBM MQ messages from a queue.

The majority of the messages are read correctly, but if there is a message with a blank 'Data Format' in the RFH2 header, the message is placed to the back out queue with the exception in splunkd.log:

/splunk/etc/apps/jms_ta/bin/jms.py" Examine the message data and ensure that it is of the correct format to be parsed as an MQJMS Message.

Of course I can look to amend the source system so that the data format is set, but is there anyway within Splunk I can force a default format like MQSTR?

[Damien_Dallimor · Accepted solution]

This error is thrown by the underlying WAS MQ JMS provider jars.

So it is not something addressable in the JMS Modular Input code or Splunk.

It appears a non-JMS / non-parseable message was placed on the queue.

More info on this error , code JMSCMQ0018