All Apps and Add-ons

AppFlow Data is not visible in the Citrix App

mmanfred
Explorer

I have Splunk 6.2.3, Latest IPFIX and Citrix App and Netscaler 10.x. IPFIX listener is up and netscaler is sending appflow data to it.

I am able to query eventtype=netscaler but the appFlow dashboards seem to be looking for eventtype=netscaler_appflow which does not exist.

sourcetype=ipfix for these events and I see in the eventtypes.conf:
[netscaler_appflow]
search = eventtype=netscaler sourcetype=appflow

there is no sourcetype=appflow.
my input.conf only has the python [ script line
<pre>
[script:\/\/./bin/scripted_inputs/deploy_splunk_ta_netscaler.py]
interval = -1
index=_internal
sourcetype=netscaler:installer
disabled = 0
passAuth = splunk-system-user
</pre>

am I missing a setup step that creates that sourcetype?

0 Karma
1 Solution

mmanfred
Explorer

Ah -
Two things:
1 - my inputs.conf needed to be
[ipfix://NetScaler_AppFlow]
sourcetype = appflow
index = netscaler
address = 0.0.0.0
port = 4739
buffer = 1048576
disabled = true
2- when I setup the IPFIX data input i didnt name it NetScaler_AppFlow so the above didnt match

View solution in original post

0 Karma

mmanfred
Explorer

Ah -
Two things:
1 - my inputs.conf needed to be
[ipfix://NetScaler_AppFlow]
sourcetype = appflow
index = netscaler
address = 0.0.0.0
port = 4739
buffer = 1048576
disabled = true
2- when I setup the IPFIX data input i didnt name it NetScaler_AppFlow so the above didnt match

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...