why am i not receiving data when using the Citrix for XenDesktop7 template?

[TheOnlyOne1986]

i have installed the template Citrix XenDesktop7

On my Broker i have installed the SplunkUniversialForwarder and the template i have copied directly in the path from the forwarder.
C:\Program Files\SplunkUniversalForwarder

But i get any data. the log /var/log tell me no error messages.

Can anybody tell whats wrong?

[jconger]

There are a few things to check:

1. Looking at the picture you attached, it looks like you are using Splunk_TA_windows. Are you getting data from that TA? I just want to make sure you have communication from the Splunk Universal Forwarder to the Splunk index.
2. Did you change the account the Splunk Windows service runs as? The scripts in the TA-XD7-Broker folder need to run as a Citrix administrator. By default, the Splunk Windows service runs as local system and this account does not have rights to query the Citrix broker via PowerShell.
3. Did you install the Template for XenDesktop 7 on your Splunk indexer/search heads? This needs to be done in order to create the necessary indexes and lookups for the received data from your broker.
4. Did you install the TA-XD7-VDA on any of your VDA machines? TA-XD7-VDA collects a lot of the performance information.

[hortonew]

We were working through this Saturday, but it seems he's getting a permission issue with calling the powershell scripts. I'm wondering if when configuring Splunk to run as this account, the account doesn't have access on the local machine to call the powershell scripts.

[jconger]

The account needs to be a local administrator and a Citrix admin. Also, I forgot to mention that you need to set the PowerShell execution policy to RemoteSigned at a minimum. Try running the PowerShell scripts directly from the console as well to get more information.

[hortonew]

To be clear, do you have the app placed in C:\Program Files\SplunkUniversalForwarder\etc\apps\ ?

Also, it looks like this app contains add-ons for the universal forwarders - they're in appserver/addons. These are the ones that should be placed and configured in etc/apps.

[hortonew]

You'll need to make sure indexes.conf with the indexes for this app are configured on your Splunk indexer before you'll receive data.

[hortonew]

Also, you'll need to make sure outputs.conf is configured to send to your Splunk instance.

[TheOnlyOne1986]

hello,

please see the picture

I am an absolute beginner in splunk
I did everything as instructed but nothing happens 😞

Do I have something to adjust in splunk the app to feed with data?,Hello,
please see the picture

I am an absolute beginner in splunk
I did everything as instructed but nothing happens 😞

Do I have something to adjust in splunk the app to feed with data?