MQ Modular input not working

[joshuariley]

I cannot get the MQ modular input to work at all. When I execute the mqinputs.py manually I recieve the following:

root@dabcmiqm1:/opt/splunkforwarder/bin:> ./splunk cmd /usr/bin/python "/opt/splunkforwarder/etc/apps/mq_ta/bin/mqinput.py"
Traceback (most recent call last):
File "/opt/splunkforwarder/etc/apps/mq_ta/bin/mqinput.py", line 20, in
import xml.sax.saxutils
File "/opt/freeware/lib/python2.7/xml/sax/saxutils.py", line 6, in
import os, urlparse, urllib, types
File "/opt/freeware/lib/python2.7/urllib.py", line 30, in
import base64
File "/opt/freeware/lib/python2.7/base64.py", line 10, in
import binascii
ImportError: Could not load module /opt/freeware/lib/python2.7/lib-dynload/binascii.so.
Dependent module /opt/splunkforwarder/lib/libz.a(libz.so.1) could not be loaded.
The module has an invalid magic number.
Could not load module /opt/freeware/lib/python2.7/lib-dynload/binascii.so.
Dependent module /opt/freeware/lib/python2.7/lib-dynload/binascii.so could not be loaded.

Any help with this would be greatly appreciated!

[jjw420]

Looks like it trying to load /opt/freeware/lib/python2.7/lib-dynload/binascii.so but cannot do so. Somewhere you are telling the python interpreter to load libraries from /opt/freeware/lib/python2.7. Normally all libraries loading by Splunk's python interpreter comes from /opt/splunk. The software add on is unable to function unless it has a working Python language environment.

This is what I would suggest:
1.) Always run Splunk under it's own user so that other python installations on the system do not interfere with Splunk's python interpreter.
2.) Check the PYTHONPATH and check where Splunk's python is loading libraries from.

3.) Use Splunk's python interpreter and make sure you can import all libraries using "import". eg. "import binascii"
4.) The only libraries that are not already provided by Splunk's python interpreter are the pymqi and c_types libraries (as documented here: https://github.com/jjjw420/splunk-ibm-websphere-mq-add-on.

Good luck and keep Splunk's PYTHONPATH clean!