Splunk ingesting MSMQ Message

[rick_harrison]

I have a legacy logging application that sends its messages to a MSMQ queue. Can splunk be configured to read data directly from the queue? Or do i need to write a listener application that reads the data and sends the message to Splunk via TCP?

[nczeczulin_splu]

There is a modular input for MSMQ that can consume the messages. It also has support for writing your own plug-ins (refer to IMessageHandler.cs, and ExampleHandlerTemplate.cs) to deserialize the body data before emitting to Splunk.

[wagnerbianchi]

Have you guys done any scripts in this sense? Is it working? I have a case in which we will try to collect MSMQ information to monitor queues in Splunk...any hint on that? I will appreciate any help in this matter, thanks!

[Kate_Lawrence-G]

Hi,

You can't read the MSMQ natively (it's not in the right format). You'll have to write a wrapper that either ports it to another TCP port and read it from there are write up a .net/vbscript and do a scripted input from there.

~Kate