citrix VDI & WAF logs onboarding into splunk

[Sankar]

Hi All,

I am looking for help onboard citrix VDI logs & Citrix WAF logs into the splunk. Splunk add on not available. also we got confirmed splunk support.

can anyone help & guide what is best practice onboard citrix VDI & WAF logs.

much appreciated if you have solutions.  

[Sankar]

Thanks for reply. it will helpful information, currently working with this, lets update once its been done.

I am looking Citrix WAF logs onboard into the splunk. do you have any suggestions?

[livehybrid]

Hi @Sankar 

Please can you check that https://splunkbase.splunk.com/app/6280 (Citrix Analytics Add-on for Splunk) doesnt solve any of your requirements? I am not too familiar with Citrix but it does specifically mention VDI.

Aside from that, you would need to check the the output capabilities from the Citrix tooling, I suspect that it will be syslog unless it has a dedicated Splunk output.

If you end up going down the syslog route then you should look into using Splunk Connect for Syslog (SC4S) or using something like rsyslog to capture the syslog feed onto the filesystem and then forward in to Splunk with a UF.

I would recommend sending the data to a development environment first, ensuring that you configure the relevant props/transforms to ensure they meet your requirements before sending to your production environment.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing