https://community.splunk.com/t5/Getting-Data-In/Citrix-NetScaler-sourcetype-for-HEC/m-p/748976#M119034 <P>The current&nbsp;Netscaler guidance is that logs should be exported via HEC. However, it seems like the app doesn't have a sourcetype for HEC. Any guidance on that?</P><P><A href="https://docs.netscaler.com/en-us/citrix-adc/current-release/observability/auditlogs-splunk-integration.html" target="_blank">https://docs.netscaler.com/en-us/citrix-adc/current-release/observability/auditlogs-splunk-integration.html</A></P> Mon, 30 Jun 2025 20:15:16 GMT _joe 2025-06-30T20:15:16Z https://community.splunk.com/t5/Getting-Data-In/Citrix-NetScaler-sourcetype-for-HEC/m-p/748976#M119034 <P>The current&nbsp;Netscaler guidance is that logs should be exported via HEC. However, it seems like the app doesn't have a sourcetype for HEC. Any guidance on that?</P><P><A href="https://docs.netscaler.com/en-us/citrix-adc/current-release/observability/auditlogs-splunk-integration.html" target="_blank">https://docs.netscaler.com/en-us/citrix-adc/current-release/observability/auditlogs-splunk-integration.html</A></P> Mon, 30 Jun 2025 20:15:16 GMT https://community.splunk.com/t5/Getting-Data-In/Citrix-NetScaler-sourcetype-for-HEC/m-p/748976#M119034 _joe 2025-06-30T20:15:16Z https://community.splunk.com/t5/Getting-Data-In/Citrix-NetScaler-sourcetype-for-HEC/m-p/748980#M119035 <P>The recommended way of receiving Netscaler events is by Splunk's own addon&nbsp;<A href="https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/About" target="_blank">https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/About</A></P><P>You might want to try to use the same sourcetype but I have no idea what the format will be if you do it according to Netscaler's docs.</P> Mon, 30 Jun 2025 21:55:14 GMT https://community.splunk.com/t5/Getting-Data-In/Citrix-NetScaler-sourcetype-for-HEC/m-p/748980#M119035 PickleRick 2025-06-30T21:55:14Z