I am using the SPlunk JMS Modular Input to read data off a JMS Queue. I've set up the Modular Input and data is being read off the queue as expected. However, I am having some issues with applying the correct timestamp to the event on indexing. I am not sure if it is related to the JMS Modular Input in some way or not. If I make a file that contains the event and add it via the splunk web, everything is perfect (the correct field is used as a timestamp, all the fields are extracted, etc). But when I try to index the live data from the JMS Queue, it does not seem to be applying the props.conf. The event timestamp is the current time and none of the fields are extracted. This is a sample of one of the events read off the queue:
[{ "host":"myhost", "observer":"bb","timestamp":145392582610,"group":{"units":"bps","location":"MD"},"start":1453925400000, "stop":1453925700000, "user":"jdoe"}]
I have set up a message handler because I may eventually want to do something with the message before it is sent (and I wanted to see how it works). My code is:
public class MyMessageHandler extends AbstractMessageHandler {
@Override
public void handleMessage(Message message, MessageReceiver context) throws Exception{
String event = getMessageBody(message);
transportMessage(event, String.valueOf(System.currentTimeMillis()), "");
}
@Override
public void setParams(Mapparams) {}
}
props.conf:
[jms-zebra]
INDEXED_EXTRACTIONS= json
KV_MODE = none
TIMESTAMP_FIELDS = stop
MAX_TIMESTAMP_LOOKAHEAD =20
NO_BINARY_CHECK=TRUE
MAX_EVENTS=1000
TRUNCATE=100000
category=Structured
disabled=false
pulldown_type=true
inputs.conf:
[jms://queue/:Consumer.jms.zebra]
browse_frequency=30
browse_mode=all
browse_queue_only=0
destination_pass = *******
destination_user = system
durable = 0
index = zeb
index_message_header = 0
index_message_properties = 0
init_mode = local
local_init_mode_resource_factory_impl = org.splunkintegration.jms.LocalActiveMQJMSResourceFactory
local_init_mode_resource_factory_params=serverURL=tcp://xxx.xxx.xx.xx:61616,userName=system,password=*******
message_handler_impl = org.splunkintegration.jms.MyMessageHandler
message_selector=type=summary
strip_newlines=1
sourcetype=jms-zebra
↧