Getting Data In

How to set up a JMS listener and get it indexed in Splunk?

mmohiuddin
Path Finder

I have successfully set up a jms listener, but do not see the messages being pulled by splunk. I have created the inputs via Splunk UI on the JMS database inputs.

I am able to successfully authenticate with the JNDI Username and password as well as Topic/Queue Username and password.

I am not sure what are the next setup procedures.

Splunk is not able to pull messages from these queues.

Tags (2)

Damien_Dallimor
Ultra Champion

I am going to have to make some presumptions here if I am to help you.

1) you are using the JMS Messaging Modular Input
2) you are trying to connect to a Websphere MQ queue manager

I would then suggest reading and following exactly the instructions detailed in this blog

0 Karma

mmohiuddin
Path Finder

These are the errors I am getting on splunkd.log

ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" Stanza jms://queue/QA:QA.EA.ELOG.BUSINESSEVENT : Error connecting : javax.naming.NameNotFoundException:< queuename>
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.getObjectFromBindings(RefFSContext.java:400)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at javax.naming.InitialContext.lookup(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

0 Karma

mmohiuddin
Path Finder

This is my jms input setup:

[jms://queue/splunkqueue]
browse_mode = stats
browse_queue_only = 0
durable = 0
index =
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkQConnectionFactory1
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:///
sourcetype =
strip_newlines = 0
jndi_user =
jndi_pass =
disabled = 0
destination_pass =
destination_user =
browse_frequency = -1

0 Karma

mmohiuddin
Path Finder

We are using splunk to pull messages from the queue. I have written the modular inputs.

0 Karma

Damien_Dallimor
Ultra Champion

Can you clarify your question more accurately.....

Have you written your own JMS client as a Splunk Scripted Input or Modular Input ?

Are you using an existing Splunk App that you need help configuring / troubleshooting ?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...