Archive
Highlighted

Splunk ingesting MSMQ Message

New Member

I have a legacy logging application that sends its messages to a MSMQ queue. Can splunk be configured to read data directly from the queue? Or do i need to write a listener application that reads the data and sends the message to Splunk via TCP?

Tags (1)
0 Karma
Highlighted

Re: Splunk ingesting MSMQ Message

Contributor

Hi,

You can't read the MSMQ natively (it's not in the right format). You'll have to write a wrapper that either ports it to another TCP port and read it from there are write up a .net/vbscript and do a scripted input from there.

~Kate

Highlighted

Re: Splunk ingesting MSMQ Message

Splunk Employee
Splunk Employee

Have you guys done any scripts in this sense? Is it working? I have a case in which we will try to collect MSMQ information to monitor queues in Splunk...any hint on that? I will appreciate any help in this matter, thanks!

0 Karma
Highlighted

Re: Splunk ingesting MSMQ Message

Splunk Employee
Splunk Employee

There is a modular input for MSMQ that can consume the messages. It also has support for writing your own plug-ins (refer to IMessageHandler.cs, and ExampleHandlerTemplate.cs) to deserialize the body data before emitting to Splunk.

0 Karma