I have netscaler configured for Splunk using Splunk for Netscaler and the IPFix Appflow packages and I am receiving IPFIX but most of the Appflow fields remain empty?

[jmkosky]

I have configured Splunk for Citrix Netscaler on a Ubuntu linux box and the accompanying ipfix/appflow add on and I am receiving ipfix events. The problem is that most of the fields in the Splunk for Citrix Netscaler Appflwo section remain empty. Any advice on this?

[jcoates_splunk · Accepted solution]

Hi, have you tried this? http://docs.splunk.com/Documentation/AddOns/latest/IPFIX/ConfigureEnterpriseInformationElements