Splunk Search

Splunk ingesting MSMQ Message

rick_harrison
New Member

I have a legacy logging application that sends its messages to a MSMQ queue. Can splunk be configured to read data directly from the queue? Or do i need to write a listener application that reads the data and sends the message to Splunk via TCP?

Tags (1)
0 Karma

nczeczulin_splu
Splunk Employee
Splunk Employee

There is a modular input for MSMQ that can consume the messages. It also has support for writing your own plug-ins (refer to IMessageHandler.cs, and ExampleHandlerTemplate.cs) to deserialize the body data before emitting to Splunk.

0 Karma

wagnerbianchi
Splunk Employee
Splunk Employee

Have you guys done any scripts in this sense? Is it working? I have a case in which we will try to collect MSMQ information to monitor queues in Splunk...any hint on that? I will appreciate any help in this matter, thanks!

0 Karma

Kate_Lawrence-G
Contributor

Hi,

You can't read the MSMQ natively (it's not in the right format). You'll have to write a wrapper that either ports it to another TCP port and read it from there are write up a .net/vbscript and do a scripted input from there.

~Kate

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...