Netscaler Application Firewall & Splunk Netscaler App

[horizonsecurity]

Hi,
we have configured Netscaler Application Firewall to send logs via syslog to Splunk Netscaler App.
We can see correctly the logs on Splunk general search dashboard (under ns_log), but unfortunatly using the "Netscaler App" > "Web Application Firewall" we receive this message below.

Can you help me to understand what can be done to solve the issue? The objective is to use the predefined graphs and searchs.

Thanks.

===========================================================================================
This search has completed and found 303 matching events. However, the transforming commands in the highlighted portion of the following search:

search sourcetype = ns_log APPFW | stats count by violation src_ip url host profile msg msg_description log_type msg_format action _time

over the time range:

10/24/12 5:22:00.000 PM – 10/24/12 5:37:18.000 PM

generated no results. Possible solutions are to: check the syntax of the commands verify that the fields expected by the report commands are present in the events

=================================================================================

[dart]

The issue stems from one of the fields not being present in your data. Try just running a search for sourcetype = ns_log APPFW and then check the field picker for:

• violation
• src_ip
• host
• profile
• msg
• msg_description
• log_type
• msg_format
• action

One or more of those fields is missing. You can then use the Interactive field extractor to extract the missing fields.

[horizonsecurity]

Ok, I used the extractor and it seems to work.
But I was expected that the Netscaler App already has this function included, because I can see that the pre-packaged queries/search/graphs include in the installation use this fields. Have you an idea about the lack of this default extractor?

[jolv]

Im having the same problem. We are running netscaler 10