NetScaler 10

[waelaltaqi]

we're trying to get Splunk working with NetScaler 10.
What's done on NetScaler
1. AppFlow collector is added
2. AppFlow Policy is added with expression "true"
3. AppFlow Action is added to forward to collector in 10.

On Spunk, we have:
1. NetScaler app installed
2. C:\Program Files\Splunk\etc\apps\SplunkforCitrixNetScaler\default\inputs.conf is moded for Windows

I see Nothing! Is this app supported by NetScaler 10 or not?

Thanks,

[jbennett_splunk]

The current version (4.8) of "Splunk for Citrix Netscaler with appFlow" does support NetScaler 10.

If you've got appflow forwarding configured, check if the data is in the appflow.log on the splunk instance where you installed the TA (Splunk_TA_IPFIX_UDP_NIX (or WIN)).

If you've got data in the appflow.log file but not in the splunk UI, double-check the dates (if your Netscaler's clock is set wrong, the data will be indexed according to the Netscaler's clock).

[rox]

Same problem here - did you get this working? The AppFlow log is showing information from my NS but nothing showing in the GUI for either syslog or appflow.