All Apps and Add-ons

Stream App + Netscaler AddOn: Why are Netflow elements not decoded?


Hello everyone,

I am currently working on the integration of Citrix Netscaler to Splunk. I`d like to see the App-/Netflow data in Splunk to use those for traffic balancing.

My setup is as follows:

  • Splunk v8.2.4
  • Splunk App for Stream v 8.0.2 (and the TAs as well)
  • Splunk Add-on for Citrix NetScaler v8.1.1

I was following the docs and installed as described. The files from TA Citrix are copied to stream app (

Eventhough - the netflow elements appear, they are not getting decoded and I am seeing this:


Following IANA i was able to figure out that "5951" is ID of manufacturer: (which is Netscaler in this case).
Unfortunately i did not find any documentation on the decoding procedure for those bytes.

While trying to understand what the streamfwd binary does and how the solution is embedded into the python scripts, I stumbled over one interessting fact. in $SPLUNK_HOME/etc/apps/splunk_app_stream/bin/splunk_app_stream/models/ there is a refernce to this URL:
which seems to be involved into decoding somehow. However when i try to open this, it shows 404.

Coming back to the original issue: those Appflows are not decoded. Is there a known solution for this? If not, does anyone know, where those element definitions may be found?


Many thanks in advance!




PS: Seems to be related to


Tags (1)
0 Karma


I am having the same issue.  Did you find a resolution?

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...