Splunk 6.2/NetScaler 10.1 Configuration

[LouPetridish]

Hello,

I have a NetScaler in my environment setup to send the Syslog files to Splunk 6.2. It's configured to send "all" of the events available. I can modify this later but I just want to see the data flow through into Splunk.

Currently when I look at the Splunk web console with the NetScaler App installed all I see is the "SSLLOG SSL_HANDSHAKE_SUCCESS" events. I would think it would send me everything that I included under all such as 'error', 'critical', 'emergency', 'warning'....

Any thoughts?

Thank you,
Luke

[LouPetridish]

This can be closed out. I got it resolved. The handshakes show up because it's a ton of info. But if you actually start filtering things out you see a ton of information.

Sorry for the waste of time. I am new to a lot of this stuff.

[cshah2]

Hi Lou,

What App did you use for this. We are running on 10.5 version of NS and want to use an app to get field extractions in Splunk. However, the app I found online works only with 9.X release of NS. Appreciate your answer.