All Apps and Add-ons

AppFlow Data is not visible in the Citrix App

mmanfred
Explorer

I have Splunk 6.2.3, Latest IPFIX and Citrix App and Netscaler 10.x. IPFIX listener is up and netscaler is sending appflow data to it.

I am able to query eventtype=netscaler but the appFlow dashboards seem to be looking for eventtype=netscaler_appflow which does not exist.

sourcetype=ipfix for these events and I see in the eventtypes.conf:
[netscaler_appflow]
search = eventtype=netscaler sourcetype=appflow

there is no sourcetype=appflow.
my input.conf only has the python [ script line
<pre>
[script:\/\/./bin/scripted_inputs/deploy_splunk_ta_netscaler.py]
interval = -1
index=_internal
sourcetype=netscaler:installer
disabled = 0
passAuth = splunk-system-user
</pre>

am I missing a setup step that creates that sourcetype?

0 Karma
1 Solution

mmanfred
Explorer

Ah -
Two things:
1 - my inputs.conf needed to be
[ipfix://NetScaler_AppFlow]
sourcetype = appflow
index = netscaler
address = 0.0.0.0
port = 4739
buffer = 1048576
disabled = true
2- when I setup the IPFIX data input i didnt name it NetScaler_AppFlow so the above didnt match

View solution in original post

0 Karma

mmanfred
Explorer

Ah -
Two things:
1 - my inputs.conf needed to be
[ipfix://NetScaler_AppFlow]
sourcetype = appflow
index = netscaler
address = 0.0.0.0
port = 4739
buffer = 1048576
disabled = true
2- when I setup the IPFIX data input i didnt name it NetScaler_AppFlow so the above didnt match

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...