Getting Data In

How to set up a JMS listener and get it indexed in Splunk?

mmohiuddin
Path Finder

I have successfully set up a jms listener, but do not see the messages being pulled by splunk. I have created the inputs via Splunk UI on the JMS database inputs.

I am able to successfully authenticate with the JNDI Username and password as well as Topic/Queue Username and password.

I am not sure what are the next setup procedures.

Splunk is not able to pull messages from these queues.

Tags (2)

Damien_Dallimor
Ultra Champion

I am going to have to make some presumptions here if I am to help you.

1) you are using the JMS Messaging Modular Input
2) you are trying to connect to a Websphere MQ queue manager

I would then suggest reading and following exactly the instructions detailed in this blog

0 Karma

mmohiuddin
Path Finder

These are the errors I am getting on splunkd.log

ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" Stanza jms://queue/QA:QA.EA.ELOG.BUSINESSEVENT : Error connecting : javax.naming.NameNotFoundException:< queuename>
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.getObjectFromBindings(RefFSContext.java:400)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at javax.naming.InitialContext.lookup(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

0 Karma

mmohiuddin
Path Finder

This is my jms input setup:

[jms://queue/splunkqueue]
browse_mode = stats
browse_queue_only = 0
durable = 0
index =
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkQConnectionFactory1
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:///
sourcetype =
strip_newlines = 0
jndi_user =
jndi_pass =
disabled = 0
destination_pass =
destination_user =
browse_frequency = -1

0 Karma

mmohiuddin
Path Finder

We are using splunk to pull messages from the queue. I have written the modular inputs.

0 Karma

Damien_Dallimor
Ultra Champion

Can you clarify your question more accurately.....

Have you written your own JMS client as a Splunk Scripted Input or Modular Input ?

Are you using an existing Splunk App that you need help configuring / troubleshooting ?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...