Getting Data In

How to set up a JMS listener and get it indexed in Splunk?

mmohiuddin
Path Finder

I have successfully set up a jms listener, but do not see the messages being pulled by splunk. I have created the inputs via Splunk UI on the JMS database inputs.

I am able to successfully authenticate with the JNDI Username and password as well as Topic/Queue Username and password.

I am not sure what are the next setup procedures.

Splunk is not able to pull messages from these queues.

Tags (2)

Damien_Dallimor
Ultra Champion

I am going to have to make some presumptions here if I am to help you.

1) you are using the JMS Messaging Modular Input
2) you are trying to connect to a Websphere MQ queue manager

I would then suggest reading and following exactly the instructions detailed in this blog

0 Karma

mmohiuddin
Path Finder

These are the errors I am getting on splunkd.log

ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" Stanza jms://queue/QA:QA.EA.ELOG.BUSINESSEVENT : Error connecting : javax.naming.NameNotFoundException:< queuename>
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.getObjectFromBindings(RefFSContext.java:400)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookupObject(RefFSContext.java:327)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.RefFSContext.lookup(RefFSContext.java:146)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.sun.jndi.fscontext.FSContext.lookup(FSContext.java:127)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at javax.naming.InitialContext.lookup(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.connect(Unknown Source)
ERROR ExecProcessor - message from "python $SPLUNK_HOMEetcappsjms_tabinjms.py" at com.splunk.modinput.jms.JMSModularInput$MessageReceiver.run(Unknown Source)

0 Karma

mmohiuddin
Path Finder

This is my jms input setup:

[jms://queue/splunkqueue]
browse_mode = stats
browse_queue_only = 0
durable = 0
index =
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkQConnectionFactory1
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_provider_url = file:///
sourcetype =
strip_newlines = 0
jndi_user =
jndi_pass =
disabled = 0
destination_pass =
destination_user =
browse_frequency = -1

0 Karma

mmohiuddin
Path Finder

We are using splunk to pull messages from the queue. I have written the modular inputs.

0 Karma

Damien_Dallimor
Ultra Champion

Can you clarify your question more accurately.....

Have you written your own JMS client as a Splunk Scripted Input or Modular Input ?

Are you using an existing Splunk App that you need help configuring / troubleshooting ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...