I see. It seems your issue is not related with the modular input, but with your specific ActiveMQ configuration. I think the best approach will be debugging the access to ActiveMQ using a Python script that mimics the modular input. I have created a small script you can use for that. Please, check it out in https://gist.github.com/carlosabalde/956af228116cd638ff0a . Adjust your host, port and queue/topic name. Execute it in a terminal an we'll probably get an idea of what's going on looking at the stomp.py debug messages. Note the script depends on the stomp.py library. ... View more

Hi, According with that log, it seems the STOMP modular input dies due to and unhandled exception in the stomp.py library (https://github.com/kwoli/stomp.py). That's the library embedded in the modular input and used to connect to STOMP sources. Have you updated to the latest release (v0.4)? That version includes and upgrade of the stomp.py library that may fix your problem. If updating does not fix the issue, could you please provide some information about your configuration (ActiveMQ version, OS, any special configuration, etc.) in order to try to reproduce the problem. ... View more

Great 🙂 The issue was trivial. A forgot flush call in the stream which connects the modular input and Splunk. A beginner's mistake. ... View more

Hi getmesomedata! The steps you've followed are perfectly correct. It would be helpful if you can make a quick test in order to check if the issue you're experiencing is related with a strange behaviour we are still researching. We've detected some kind of event buffering somewhere in between RabbitMQ and Splunk. Due to that 'mysterious' buffering, if you test the STOMP modular input with only a few messages, they arrive at Splunk, but they are never rendered in the UI until the buffer is completely filled. So, please, repeat your test with 100 or more messages (you can use the producer.py script in https://github.com/allenta/splunk-stomp/tree/master/extras/clients if you want). Let us know if that way you are able to see the enqueued messages in the Splunk Search UI. Thank you for the report! ... View more