Getting Data In

How to set up a JMS listener and get it indexed in Splunk?

mmohiuddin
Path Finder

I have successfully set up a jms listener, but do not see the messages being pulled by splunk. I have created the inputs via Splunk UI on the JMS database inputs.

I am able to successfully authenticate with the JNDI Username and password as well as Topic/Queue Username and password.

I am not sure what are the next setup procedures.

Splunk is not able to pull messages from these queues.

Tags (2)

Damien_Dallimor
Ultra Champion

I am going to have to make some presumptions here if I am to help you.

1) you are using the JMS Messaging Modular Input
2) you are trying to connect to a Websphere MQ queue manager

I would then suggest reading and following exactly the instructions detailed in this blog

0 Karma

mmohiuddin
Path Finder

These are the errors I am getting on splunkd.log

ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" Stanza jms://queue/QA:QA.EA.ELOG.BUSINESSEVENT : Error connecting : javax.naming.NameNotFoundException:< queuename>
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.getObjectFromBindings(RefFSContext.java:400)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at javax.naming.InitialContext.lookup(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

0 Karma

mmohiuddin
Path Finder

This is my jms input setup:

[jms://queue/splunkqueue]
browse_mode = stats
browse_queue_only = 0
durable = 0
index =
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkQConnectionFactory1
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:///
sourcetype =
strip_newlines = 0
jndi_user =
jndi_pass =
disabled = 0
destination_pass =
destination_user =
browse_frequency = -1

0 Karma

mmohiuddin
Path Finder

We are using splunk to pull messages from the queue. I have written the modular inputs.

0 Karma

Damien_Dallimor
Ultra Champion

Can you clarify your question more accurately.....

Have you written your own JMS client as a Splunk Scripted Input or Modular Input ?

Are you using an existing Splunk App that you need help configuring / troubleshooting ?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...