All Apps and Add-ons

XenApp 5 - no data

diegosainz
Path Finder

I have installed the Splunk App for XenApp and I am getting data from the 6.5 version systems in my environment, but no data is coming from my version 5. I am getting Windows Event data, but none of the data from the powershell scripts.

0 Karma

jconger
Splunk Employee
Splunk Employee

Are you able to run the PowerShell scripts manually from the XenApp servers?

0 Karma

jconger
Splunk Employee
Splunk Employee

You do not need to install any cmdlets for for the TA-XA5-* addons.

Look here for XenApp 6.0 -> http://community.citrix.com/display/xa/XenApp+6+PowerShell+SDK

Look here for XenApp 6.5 -> http://community.citrix.com/display/xa/XenApp+6.5+PowerShell+SDK

diegosainz
Path Finder

What is the best way to get the correct cmdlets installed?

0 Karma

diegosainz
Path Finder

Thank you. We have found part of the problem, the citrix admin did not install the Citrix Powershell cmdlets

0 Karma

jconger
Splunk Employee
Splunk Employee

Yes, this works with Presentation Server 4.5 The PowerShell scripts used for XA5 and below are really just MFCOM wrappers and MFCOM is available in all versions of XenApp/Presentation Server/Metaframe/etc.

0 Karma

diegosainz
Path Finder

That has corrected a majority of it. Thank you. I do have another question, does this app work with presentation server 4.5?

0 Karma

diegosainz
Path Finder

I am checking with our citrix admins on that.

0 Karma

jconger
Splunk Employee
Splunk Employee

Your 6.5 Farm may have local admins as a farm administrator whereas your 5.0 farm may not. This would make a difference.

0 Karma

diegosainz
Path Finder

It runs as system (which is the same config we have the 6.5 servers that run correctly)

0 Karma

jconger
Splunk Employee
Splunk Employee

This looks correct.

Is the Splunk Windows service set to logon as a XenApp farm administrator?

0 Karma

diegosainz
Path Finder

[script://.\bin\GetICASessionStat5.path]
source=xenapp:powershell:GetICASessionStat5.ps1
sourcetype=xenapp:50:icasession
index=xenapp
interval=60
disabled=0

0 Karma

diegosainz
Path Finder

[script://.\bin\GetXAServerLoad5.path]
source=xenapp:powershell:GetXAServerload5.ps1
sourcetype=xenapp:50:serverload
index=xenapp
interval=60
disabled=0

[script://.\bin\GetXASession5.path]
source=xenapp:powershell:GetXASession5.ps1
sourcetype=xenapp:50:session
index=xenapp
interval=180
disabled=0

[script://.\bin\GetXASessionProcess5.path]
source=xenapp:powershell:GetXASessionProcess5.ps1
sourcetype=xenapp:50:sessionprocess
index=xenapp
interval=180
disabled=0

0 Karma

diegosainz
Path Finder

[script://.\bin\GetProcess.path]
source=Windows:PowerShell:getprocess.ps1
sourcetype=WMI:ProcessDetails
index=xenapp_winevents
interval=180
disabled=0

[script://.\bin\GetXAServer5.path]
source=xenapp:powershell:GetXAServer5.ps1
sourcetype=xenapp:50:server
index=xenapp
interval=300
disabled=0

[script://.\bin\GetXAServerHotfix5.path]
source=xenapp:powershell:GetXAServerHotfix5.ps1
sourcetype=xenapp:50:serverhotfix
index=xenapp
interval=300
disabled=0

0 Karma

diegosainz
Path Finder

[script://.\bin\perfmon.path]
disabled = 0
source = PerfmonMk
sourcetype = PerfmonMk
index = xenapp_perfmon

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]
disabled = 0
index = xenapp_perfmon

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0
index = xenapp_winevents

[script://.\bin\GetInstalledSoftware.path]
source=Windows:PowerShell:getinstalledsoftware.ps1
sourcetype=WMI:InstalledSoftware
index=xenapp_winevents
interval=21600
disabled=0

0 Karma

jconger
Splunk Employee
Splunk Employee

Can you post a copy of your inputs.conf file?

0 Karma

diegosainz
Path Finder

I am. I also made sure I enabled to run unsigned.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...