Citrix NetScaler and Splunk Integration

[Amira]

Hi Splunk Community,

I’m new to integrating Citrix NetScaler with Splunk, but I have about 9 years of experience working with Splunk. I need your guidance on how to successfully set up this integration to ensure that:

1. All data from NetScaler is ingested and extracted correctly.
2. The dashboards in the Splunk App for Citrix NetScaler display the expected panels and trends.

Currently, I have a 3-machine Splunk environment (forwarder, indexer, and search head). Here's what I’ve done so far:

• I installed the Splunk App for Citrix NetScaler on the search head.
• Data is being ingested from the NetScaler server via the heavy forwarder, but I have not installed the Splunk Add-on for Citrix NetScaler on the forwarder or indexer.

Despite this, the dashboards in the app show no data.

From your experience, is it necessary to install the Splunk Add-on for Citrix NetScaler on the heavy forwarder (or elsewhere) to extract and normalize the data properly? If so, would that resolve the issue of empty dashboards?

Any insights or steps to troubleshoot and ensure proper integration would be greatly appreciated!

Thanks in advance!

[gcusello]

Hi @Amira ,

you have to install the Splunk Add-on for Citrix NetScaler also on the Heavy Forwarder.

Then you have to create the index on the Indexer and  you must be sure that data are stored in the correct index.

Ciao.

Giuseppe

[Amira]

Thank you, gcusello, for your response!

I would appreciate it if you could provide more details about the importance of installing this Add-on.

Additionally, could you clarify who the owner of both the Add-on and the Application is? Were they developed by Splunk or NetScaler?

Thank you in advance!

[gcusello]

Hi @Amira ,

as you can read at https://splunkbase.splunk.com/app/2770, this addon is supported by Splunk.

as you can read at https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/Install , You have to install this add-on on HF under conditions.

I usually install all add-ons both on HFs and SHs to support index time parsing (HFs) and search time parsing (SHs).

Ciao.

Giuseppe

[Amira]

Thank you once again! I will review it on my side and let you know once I successfully complete it.

[gcusello]

Hi @Amira ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉