How to set up a JMS listener and get it indexed in Splunk?

[mmohiuddin]

I have successfully set up a jms listener, but do not see the messages being pulled by splunk. I have created the inputs via Splunk UI on the JMS database inputs.

I am able to successfully authenticate with the JNDI Username and password as well as Topic/Queue Username and password.

I am not sure what are the next setup procedures.

Splunk is not able to pull messages from these queues.

[Damien_Dallimor]

I am going to have to make some presumptions here if I am to help you.

1) you are using the JMS Messaging Modular Input
2) you are trying to connect to a Websphere MQ queue manager

I would then suggest reading and following exactly the instructions detailed in this blog

[mmohiuddin]

These are the errors I am getting on splunkd.log

ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" Stanza jms://queue/QA:QA.EA.ELOG.BUSINESSEVENT : Error connecting : javax.naming.NameNotFoundException:< queuename>
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.getObjectFromBindings(RefFSContext.java:400)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at javax.naming.InitialContext.lookup(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

[mmohiuddin]

This is my jms input setup:

[jms://queue/splunkqueue]
browse_mode = stats
browse_queue_only = 0
durable = 0
index =
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkQConnectionFactory1
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:///
sourcetype =
strip_newlines = 0
jndi_user =
jndi_pass =
disabled = 0
destination_pass =
destination_user =
browse_frequency = -1

[mmohiuddin]

We are using splunk to pull messages from the queue. I have written the modular inputs.

[Damien_Dallimor]

Can you clarify your question more accurately.....

Have you written your own JMS client as a Splunk Scripted Input or Modular Input ?

Are you using an existing Splunk App that you need help configuring / troubleshooting ?