All Apps and Add-ons

Stream App + Netscaler AddOn: Why are Netflow elements not decoded?


Hello everyone,

I am currently working on the integration of Citrix Netscaler to Splunk. I`d like to see the App-/Netflow data in Splunk to use those for traffic balancing.

My setup is as follows:

  • Splunk v8.2.4
  • Splunk App for Stream v 8.0.2 (and the TAs as well)
  • Splunk Add-on for Citrix NetScaler v8.1.1

I was following the docs and installed as described. The files from TA Citrix are copied to stream app (

Eventhough - the netflow elements appear, they are not getting decoded and I am seeing this:


Following IANA i was able to figure out that "5951" is ID of manufacturer: (which is Netscaler in this case).
Unfortunately i did not find any documentation on the decoding procedure for those bytes.

While trying to understand what the streamfwd binary does and how the solution is embedded into the python scripts, I stumbled over one interessting fact. in $SPLUNK_HOME/etc/apps/splunk_app_stream/bin/splunk_app_stream/models/ there is a refernce to this URL:
which seems to be involved into decoding somehow. However when i try to open this, it shows 404.

Coming back to the original issue: those Appflows are not decoded. Is there a known solution for this? If not, does anyone know, where those element definitions may be found?


Many thanks in advance!




PS: Seems to be related to


Tags (1)
0 Karma


I am having the same issue.  Did you find a resolution?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...