All Apps and Add-ons

Stream App + Netscaler AddOn: Why are Netflow elements not decoded?


Hello everyone,

I am currently working on the integration of Citrix Netscaler to Splunk. I`d like to see the App-/Netflow data in Splunk to use those for traffic balancing.

My setup is as follows:

  • Splunk v8.2.4
  • Splunk App for Stream v 8.0.2 (and the TAs as well)
  • Splunk Add-on for Citrix NetScaler v8.1.1

I was following the docs and installed as described. The files from TA Citrix are copied to stream app (

Eventhough - the netflow elements appear, they are not getting decoded and I am seeing this:


Following IANA i was able to figure out that "5951" is ID of manufacturer: (which is Netscaler in this case).
Unfortunately i did not find any documentation on the decoding procedure for those bytes.

While trying to understand what the streamfwd binary does and how the solution is embedded into the python scripts, I stumbled over one interessting fact. in $SPLUNK_HOME/etc/apps/splunk_app_stream/bin/splunk_app_stream/models/ there is a refernce to this URL:
which seems to be involved into decoding somehow. However when i try to open this, it shows 404.

Coming back to the original issue: those Appflows are not decoded. Is there a known solution for this? If not, does anyone know, where those element definitions may be found?


Many thanks in advance!




PS: Seems to be related to


Tags (1)
0 Karma


I am having the same issue.  Did you find a resolution?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...