Splunk Search

Splunk ingesting MSMQ Message

rick_harrison
New Member

I have a legacy logging application that sends its messages to a MSMQ queue. Can splunk be configured to read data directly from the queue? Or do i need to write a listener application that reads the data and sends the message to Splunk via TCP?

Tags (1)
0 Karma

nczeczulin_splu
Splunk Employee
Splunk Employee

There is a modular input for MSMQ that can consume the messages. It also has support for writing your own plug-ins (refer to IMessageHandler.cs, and ExampleHandlerTemplate.cs) to deserialize the body data before emitting to Splunk.

0 Karma

wagnerbianchi
Splunk Employee
Splunk Employee

Have you guys done any scripts in this sense? Is it working? I have a case in which we will try to collect MSMQ information to monitor queues in Splunk...any hint on that? I will appreciate any help in this matter, thanks!

0 Karma

Kate_Lawrence-G
Contributor

Hi,

You can't read the MSMQ natively (it's not in the right format). You'll have to write a wrapper that either ports it to another TCP port and read it from there are write up a .net/vbscript and do a scripted input from there.

~Kate

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...