All Apps and Add-ons

Where does Splunk for Citrix NetScaler with AppFlow need to be installed in a distributed search environment and where can I specify a custom index?

gn694
Communicator

In a distributed environment, where does Splunk for Citrix NetScaler with AppFlow need to be installed other than the Search Heads? Does it need to be installed on Intermediate Forwarders and/or Indexers?

Also, where can I specify an index other than netscaler to use for whatever things this app is attempting to index? We have a standard for the naming of indexes where they are all prefixed with a group name according to who is allowed access to the index. So I want to use an index named <group1>-netscaler. We already have this custom index created and configured for IPFIX inputs, but our indexers have been complaining since we installed this app "received event for unconfigured/disabled/deleted index='netscaler'"

I see in /default/macros.conf there is a stanza:
[ns_index]
definition = index=netscaler

Could I just create a macros.conf in /local and add the following (or would there be more involved to this...)
[ns_index]
definition = index=<group1>-netscaler

(As far as populating dashboards, I see in /default/eventtypes.conf there is a netscaler event type configured as index=netscaler. I have added an eventtypes.conf to the local folder setting it to be index=<group1>-netscaler.)

thank you

0 Karma

jconger
Splunk Employee
Splunk Employee

Depends on where you are sending your data from your NetScaler(s). If you are sending to the indexer(s), the Splunk_TA_Citrix-NetScaler needs to go on your indexers. If you are sending to an intermediate forwarder, then put it there instead.

You can modify the macros.conf and eventtypes.conf to specify your custom index.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...