As the received data is encoded in EBCDIC , which not understood by Splunk , you will need to write a custom message handler for the JMS Modular Input.
This custom message handler would receive the raw bytes , and translate them from EBCDIC to ASCII. You will have to find the IBM Java libraries to assist you with this translation.
1) Code your custom handler. Pseudo code example for you to follow and complete :
package com.foo;
import java.util.Map;
import javax.jms.Message;
import com.splunk.modinput.jms.AbstractMessageHandler;
import com.splunk.modinput.jms.JMSModularInput.MessageReceiver;
public class DecodeEBCDICHandler extends AbstractMessageHandler {
@Override
public void handleMessage(Message message, MessageReceiver context)
throws Exception {
String bodyContent = decodeEBCDIC(message);
transportMessage(bodyContent);
}
private String decodeEBCDIC(Message message) {
String decodedContent = "";
//write some code to get the message content and decode it
return decodedContent;
}
@Override
public void setParams(Map<String, String> params) {
// Do nothing , params not used
}
}
2) Compile it and put it in a jar file
3) Drop the jar file in jms_ta/bin/lib
4) Declare the custom handler to be applied on the JMS Mod Input setup page for your stanza
... View more
