I have installed the Splunk App for XenApp and I am getting data from the 6.5 version systems in my environment, but no data is coming from my version 5. I am getting Windows Event data, but none of the data from the powershell scripts.
Are you able to run the PowerShell scripts manually from the XenApp servers?
You do not need to install any cmdlets for for the TA-XA5-* addons.
Look here for XenApp 6.0 -> http://community.citrix.com/display/xa/XenApp+6+PowerShell+SDK
Look here for XenApp 6.5 -> http://community.citrix.com/display/xa/XenApp+6.5+PowerShell+SDK
What is the best way to get the correct cmdlets installed?
Thank you. We have found part of the problem, the citrix admin did not install the Citrix Powershell cmdlets
Yes, this works with Presentation Server 4.5 The PowerShell scripts used for XA5 and below are really just MFCOM wrappers and MFCOM is available in all versions of XenApp/Presentation Server/Metaframe/etc.
That has corrected a majority of it. Thank you. I do have another question, does this app work with presentation server 4.5?
I am checking with our citrix admins on that.
Your 6.5 Farm may have local admins as a farm administrator whereas your 5.0 farm may not. This would make a difference.
It runs as system (which is the same config we have the 6.5 servers that run correctly)
This looks correct.
Is the Splunk Windows service set to logon as a XenApp farm administrator?
[script://.\bin\GetICASessionStat5.path]
source=xenapp:powershell:GetICASessionStat5.ps1
sourcetype=xenapp:50:icasession
index=xenapp
interval=60
disabled=0
[script://.\bin\GetXAServerLoad5.path]
source=xenapp:powershell:GetXAServerload5.ps1
sourcetype=xenapp:50:serverload
index=xenapp
interval=60
disabled=0
[script://.\bin\GetXASession5.path]
source=xenapp:powershell:GetXASession5.ps1
sourcetype=xenapp:50:session
index=xenapp
interval=180
disabled=0
[script://.\bin\GetXASessionProcess5.path]
source=xenapp:powershell:GetXASessionProcess5.ps1
sourcetype=xenapp:50:sessionprocess
index=xenapp
interval=180
disabled=0
[script://.\bin\GetProcess.path]
source=Windows:PowerShell:getprocess.ps1
sourcetype=WMI:ProcessDetails
index=xenapp_winevents
interval=180
disabled=0
[script://.\bin\GetXAServer5.path]
source=xenapp:powershell:GetXAServer5.ps1
sourcetype=xenapp:50:server
index=xenapp
interval=300
disabled=0
[script://.\bin\GetXAServerHotfix5.path]
source=xenapp:powershell:GetXAServerHotfix5.ps1
sourcetype=xenapp:50:serverhotfix
index=xenapp
interval=300
disabled=0
[script://.\bin\perfmon.path]
disabled = 0
source = PerfmonMk
sourcetype = PerfmonMk
index = xenapp_perfmon
[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0
index = xenapp_perfmon
[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
index = xenapp_winevents
[script://.\bin\GetInstalledSoftware.path]
source=Windows:PowerShell:getinstalledsoftware.ps1
sourcetype=WMI:InstalledSoftware
index=xenapp_winevents
interval=21600
disabled=0
Can you post a copy of your inputs.conf file?
I am. I also made sure I enabled to run unsigned.