How to feed IBM MQ logs into Splunk?

cn flag

Our Java-program talks to IBM MQ using IBM-provided JAR. As documented by IBM, log-messages generated from within the JAR are written out into mqjms.log in the current directory.

The above link explains, how the location -- and/or the filename -- can be changed, but that's all the flexibility there is documented...

Our own code uses log4j with appenders configured for both local files and for the corporate Splunk -- using Splunk's own JARs.

Is it possible to configure IBM MQ client JAR to feed log-entries directly into Splunk as well? Splunk document, how to feed their server from several Java logging frameworks -- is IBM MQ using any of them? Can it be made to?

Update: I'd rather not feed Splunk by way of printing -- be it into a file watched by Splunk Forwarding Agent -- or other means. Because the printed log-entry loses some information. And because multi-line entries (such as those with Java-exceptions) will generate a logging event for each line.

br flag
Could you install the splunk client forwarder to just tail that file locally?
JoshMc avatar
ar flag
Besides pointing to a specific file the only other option you have is to tm point to System.err or System.out, could you use something like [this]( to have System.err go to log4j which is then configured to send to splunk?
cn flag
Thanks for the suggestions -- I updated the question with the explanation, why I'd rather not go through text-file.

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.