Splunk Cloud Platform

Remove JMS event headers

jsanjeb
Explorer

Hi Splunkers,

I have a setup where heavy forwarder is made to read data from MQ through JMS app and it will forward to splunk cloud(Indexer and search head). When the data I available at splunk cloud it is seen with a header showing details of queue from where it is read as below,

Thu Apr 26 05:22:25 CDT 2018 name=QUEUE_msg_received event_id=ID:414d5120504443524444303220202020f4decc5ac80d5121 msg_dest=MFTTRANSACTION.EVENTS.LOG.INPUT.QUEUE msg_body=<?xml version="1.0" encoding="UTF-8"?><transaction version="6.00" ID="414d512050445053514d443031202020c995d15af77c7e2f" agentRole="sourceAgent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="TransferLog.xsd" xmlns=""><action time="2018-04-26T10:22:09.656Z">progress</action><sourceAgent agent="B051U003_DEV_CHINA" QMgr="PPMFTD01" agentType="STANDARD"><checksum method="none"/></destination><status resultCode="0"></status></item></transferSet></transaction>

Unwanted header,

Thu Apr 26 05:22:25 CDT 2018 name=QUEUE_msg_received event_id=ID:414d5120504443524444303220202020f4decc5ac80d5121 msg_dest=MFTTRANSACTION.EVENTS.LOG.INPUT.QUEUE msg_body=

How to stop the above header from being added to actual xml data as my indexer is unable to identify the input as XML and it is failing to extract fields?

I have tried routing to nullqueue post indexing but it is not working. Hence I am looking for a solution in forwarder level.

Thanks in advance

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...