Anyone having any luck with creating JMS Input with HEC (HTTP Event Collector) mode (output_type)? I am getting HTTP 400 Bad request error when the messages are sent to the queue. Below is my Input. Let me know if i am doing anything wrong. inputs.conf [ jms://queue/queue_name] browse_frequency = -1 browse_mode = all browse_queue_only = 0 destination_pass = password destination_user = username durable= 0 hec_batch_mode = 0 hec_https = 1 hec_port = 8088 hec_token = token index = hadoopmon index_message_header = 0 index_message_properties = 0 init_mode = jndi jms_connection_factory_name = SplunkQConnectionFactory jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory jndi_pass = password jndi_provider_url = binding file location jndi_user = username message_handler_impl = com.splunk.modinput.jms.custom.handler.BodyOnlyMessageHandler output_type = hec source = queue/queue_name sourcetype = hadoopmon_dev strip_newlines = 1 ... View more

We have an issue when we add new JMS modular input. Everything looks ok but it still shows JMS errors connecting. Additionally it blocks messages from coming in for All the other modular inputs when i enable the new one. Also we have tested this in our QA environment. It only doesn't work in Prod. Inputs.conf: [jms://queue/QUEUE_NAME] browse_mode = all browse_queue_only = 0 durable = 0 index = INDEXNAME index_message_header = 0 index_message_properties = 0 init_mode = jndi jms_connection_factory_name = SplunkQConnectionFactory jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory jndi_provider_url = file:///F:/splunk/etc/apps/jms_ta/local/Hadoop/prod sourcetype = hadoopmon_prod strip_newlines = 0 jndi_user = USERNAME jndi_pass = PASSWORD disabled = 0 destination_pass = USERNAME destination_user = PASSWORD browse_frequency = -1 hec_batch_mode = 0 hec_https = 0 output_type = stdout Error Message: 1/25/17 13:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" Traceback (most recent call last): 1/25/17 13:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" File "F:\Splunk\etc\apps\jms_ta\bin\jms.py", line 131, in 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" do_run() 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" File "F:\Splunk\etc\apps\jms_ta\bin\jms.py", line 50, in do_run 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" run_java() 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" File "F:\Splunk\etc\apps\jms_ta\bin\jms.py", line 101, in run_java 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" process = Popen(java_args) 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" File "F:\Splunk\Python-2.7\Lib\subprocess.py", line 710, in __init__ 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" errread, errwrite) 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" File "F:\Splunk\Python-2.7\Lib\subprocess.py", line 958, in _execute_child 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" startupinfo) 1/25/17 1:42:35.536 PM 01-25-2017 13:42:35.536 -0500 ERROR ExecProcessor - message from "python F:\Splunk\etc\apps\jms_ta\bin\jms.py" WindowsError: [Error 87] The parameter is incorrect ... View more