In a distributed environment, where does Splunk for Citrix NetScaler with AppFlow need to be installed other than the Search Heads? Does it need to be installed on Intermediate Forwarders and/or Indexers?
Also, where can I specify an index other than netscaler to use for whatever things this app is attempting to index? We have a standard for the naming of indexes where they are all prefixed with a group name according to who is allowed access to the index. So I want to use an index named <group1>-netscaler. We already have this custom index created and configured for IPFIX inputs, but our indexers have been complaining since we installed this app "received event for unconfigured/disabled/deleted index='netscaler'"
I see in /default/macros.conf there is a stanza:
definition = index=netscaler
Could I just create a macros.conf in /local and add the following (or would there be more involved to this...)
definition = index=<group1>-netscaler
(As far as populating dashboards, I see in /default/eventtypes.conf there is a netscaler event type configured as index=netscaler. I have added an eventtypes.conf to the local folder setting it to be index=<group1>-netscaler.)
Depends on where you are sending your data from your NetScaler(s). If you are sending to the indexer(s), the SplunkTACitrix-NetScaler needs to go on your indexers. If you are sending to an intermediate forwarder, then put it there instead.
You can modify the macros.conf and eventtypes.conf to specify your custom index.