Getting Data In

Splunk add on for Citrix Netscaler

hectorvp
Communicator

Do I need dedicated syslog server to get syslog messages and then forward it using Universal Forwarder??Considering I've installed on Splunk add on for Netscaler over a HF. If this is to be then what is significance of having add on over UF.

   OR

Can I directly listen on heavy forwarder over a port 514 to get messages.Considering I've installed on Splunk add on for Netscaler over a HF.

 

Can I manage any configuration regarding this add on using Deployment Server?? Like managing which inputs to be monitored and all.

PS: I'm new with Netscaler

Labels (3)
0 Karma

splunkcol
Contributor

I have a heavy forwarder which receives netscaler logs through syslog using port 514

then with inputs and outputs I forward the information to the indexers.

those apps are sometimes a headache about the configuration

0 Karma

hectorvp
Communicator

I've two netscaler appliances and don't have knowledge yet how heavily those would generate logs.

Is it ok if I go with 2nd option, to listen directly over HF for syslog messages and having splunk add on in place? Will this work fine...?

Or  should I get another server as a syslog server and having UF over it. Would I need this add on anymore on this dedicated syslog server.

PS: Having dedicated syslog server would increase costing and maintenance as well.

 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!