When you install the Universal Forwarder on your XenApp server(s), you should have the following directory (assuming you used the default):
C:\Program Files\SplunkUniversalForwarder
On your Splunk server, after you install the Template for Citrix XenApp, you should have the following directory:
$SPLUNK_HOME/etc/apps/TexmplateForXenApp
Note: $SPLUNK_HOME will be wherever you installed Splunk.
Now, you need to copy the appropriate TA folders to your XenApp server(s). All XenApp servers should get TA-XA6x-Server. So copy this folder on your Splunk server:
$SPLUNK_HOME/etc/apps/TemplateForXenApp/appserver/addons/TA-XA6x-Server
To this folder on your XenApp Server(s):
C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-Server
If you have a dedicated Zone Data Collector (ZDC), copy this folder on your Splunk server:
$SPLUNK_HOME/etc/apps/TemplateForXenApp/appserver/addons/TA-XA6x-ZDC
To this folder on your XenApp ZDC:
C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-XA6x-ZDC
If you don't have a dedicated Zone Data Collector, just copy TA-XA6x-ZDC to one of your XenApp servers.
Repeat the same steps above for your specified Citrix XML server (i.e. the one Web Interface or StoreFront points to). If you don't have a specific Citrix XML server, just copy TA-XA6x-XML to one of your XenApp servers.
... View more