Hi Splunkers,
I have a setup where heavy forwarder is made to read data from MQ through JMS app and it will forward to splunk cloud(Indexer and search head). When the data I available at splunk cloud it is seen with a header showing details of queue from where it is read as below,
Thu Apr 26 05:22:25 CDT 2018 name=QUEUE_msg_received event_id=ID:414d5120504443524444303220202020f4decc5ac80d5121 msg_dest=MFTTRANSACTION.EVENTS.LOG.INPUT.QUEUE msg_body=<?xml version="1.0" encoding="UTF-8"?><transaction version="6.00" ID="414d512050445053514d443031202020c995d15af77c7e2f" agentRole="sourceAgent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="TransferLog.xsd" xmlns=""><action time="2018-04-26T10:22:09.656Z">progress</action><sourceAgent agent="B051U003_DEV_CHINA" QMgr="PPMFTD01" agentType="STANDARD"><checksum method="none"/></destination><status resultCode="0"></status></item></transferSet></transaction>
Unwanted header,
Thu Apr 26 05:22:25 CDT 2018 name=QUEUE_msg_received event_id=ID:414d5120504443524444303220202020f4decc5ac80d5121 msg_dest=MFTTRANSACTION.EVENTS.LOG.INPUT.QUEUE msg_body=
How to stop the above header from being added to actual xml data as my indexer is unable to identify the input as XML and it is failing to extract fields?
I have tried routing to nullqueue post indexing but it is not working. Hence I am looking for a solution in forwarder level.
Thanks in advance
