I have a legacy logging application that sends its messages to a MSMQ queue. Can splunk be configured to read data directly from the queue? Or do i need to write a listener application that reads the data and sends the message to Splunk via TCP?
There is a modular input for MSMQ that can consume the messages. It also has support for writing your own plug-ins (refer to IMessageHandler.cs, and ExampleHandlerTemplate.cs) to deserialize the body data before emitting to Splunk.
Have you guys done any scripts in this sense? Is it working? I have a case in which we will try to collect MSMQ information to monitor queues in Splunk...any hint on that? I will appreciate any help in this matter, thanks!
Hi,
You can't read the MSMQ natively (it's not in the right format). You'll have to write a wrapper that either ports it to another TCP port and read it from there are write up a .net/vbscript and do a scripted input from there.
~Kate