Splunk Cloud Platform

Remove JMS event headers

jsanjeb
Explorer

Hi Splunkers,

I have a setup where heavy forwarder is made to read data from MQ through JMS app and it will forward to splunk cloud(Indexer and search head). When the data I available at splunk cloud it is seen with a header showing details of queue from where it is read as below,

Thu Apr 26 05:22:25 CDT 2018 name=QUEUE_msg_received event_id=ID:414d5120504443524444303220202020f4decc5ac80d5121 msg_dest=MFTTRANSACTION.EVENTS.LOG.INPUT.QUEUE msg_body=<?xml version="1.0" encoding="UTF-8"?><transaction version="6.00" ID="414d512050445053514d443031202020c995d15af77c7e2f" agentRole="sourceAgent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="TransferLog.xsd" xmlns=""><action time="2018-04-26T10:22:09.656Z">progress</action><sourceAgent agent="B051U003_DEV_CHINA" QMgr="PPMFTD01" agentType="STANDARD"><checksum method="none"/></destination><status resultCode="0"></status></item></transferSet></transaction>

Unwanted header,

Thu Apr 26 05:22:25 CDT 2018 name=QUEUE_msg_received event_id=ID:414d5120504443524444303220202020f4decc5ac80d5121 msg_dest=MFTTRANSACTION.EVENTS.LOG.INPUT.QUEUE msg_body=

How to stop the above header from being added to actual xml data as my indexer is unable to identify the input as XML and it is failing to extract fields?

I have tried routing to nullqueue post indexing but it is not working. Hence I am looking for a solution in forwarder level.

Thanks in advance

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...