All Apps and Add-ons

Stream App + Netscaler AddOn: Why are Netflow elements not decoded?


Hello everyone,

I am currently working on the integration of Citrix Netscaler to Splunk. I`d like to see the App-/Netflow data in Splunk to use those for traffic balancing.

My setup is as follows:

  • Splunk v8.2.4
  • Splunk App for Stream v 8.0.2 (and the TAs as well)
  • Splunk Add-on for Citrix NetScaler v8.1.1

I was following the docs and installed as described. The files from TA Citrix are copied to stream app (

Eventhough - the netflow elements appear, they are not getting decoded and I am seeing this:


Following IANA i was able to figure out that "5951" is ID of manufacturer: (which is Netscaler in this case).
Unfortunately i did not find any documentation on the decoding procedure for those bytes.

While trying to understand what the streamfwd binary does and how the solution is embedded into the python scripts, I stumbled over one interessting fact. in $SPLUNK_HOME/etc/apps/splunk_app_stream/bin/splunk_app_stream/models/ there is a refernce to this URL:
which seems to be involved into decoding somehow. However when i try to open this, it shows 404.

Coming back to the original issue: those Appflows are not decoded. Is there a known solution for this? If not, does anyone know, where those element definitions may be found?


Many thanks in advance!




PS: Seems to be related to


Tags (1)
0 Karma


I am having the same issue.  Did you find a resolution?

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...