About jconger

jconger · ‎09-26-2013

The snapins should go in "C:\Program Files\SplunkUniversalForwarder\etc\apps"

jconger · ‎07-01-2013

Did you set up your Splunk indexer for receiving data?

jconger · ‎06-24-2013

You need change the Splunk services on the PVS XenApp servers to start manually instead of automatically. Then, you will need to use a startup script to set the Splunk universal forwarder host name to the XenApp server's hostname. The startup script runs after PVS has assigned the hostname and GUIDs, so each XenApp server will report its correct information to the Splunk indexer. These steps are documented here: http://docs.splunk.com/Documentation/XenApp/latest/DeployXenApp/Installtheuniversalforwarder#Using_a_shared.2Fdistributed_image

jconger · ‎06-13-2013

Here is an example to get Disconnected session duration. You can modify to get active as well: index=xenapp sourcetype=xenapp:*:session State="Disconnected" | dedup ServerName SessionId | sort - CurrentTime | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(CurrentTime) mkTime(DisconnectTime) | eval DisconnectDuration = tostring(CurrentTime - DisconnectTime, "duration") | table LogOnTime UserName ServerName SessionId DisconnectDuration | rename DisconnectDuration AS "Disconnect Duration"

jconger · ‎06-13-2013

You can get ICA Roundtrip Latency Median from perfmon, but this is the median time of ICA roundtrip latency for all sessions on the server. http://support.citrix.com/proddocs/topic/xenapp65-admin/ps-ref-counters-ctx-cps-count.html

jconger · ‎06-06-2013

Did you install the Splunk App for Server Virtualization http://splunk-base.splunk.com/apps/63700/splunk-app-for-server-virtualization This app creates the index needed for the Technology Addon for Hyper-V

jconger · ‎05-30-2013

The error you see in the _internal index happens when the perfmon polling is not able to sample a value at startup and can be considered non-critcal. This message has actually changed to a warning going forward. During the next clock tick, the value should be sampled and processing will continue as normal. Since you are not seeing perfmon data from the Citrix counters, you may have to re-register your ICA counters. Here is a link with more information -> http://docs.splunk.com/Documentation/XenApp/latest/DeployXenApp/Troubleshooting

jconger · ‎05-07-2013

There is not a Logoff field available. However, we can write a search to get session duration (active, disconnected, etc.).

jconger · ‎04-25-2013

You do not need to install any cmdlets for for the TA-XA5-* addons. Look here for XenApp 6.0 -> http://community.citrix.com/display/xa/XenApp+6+PowerShell+SDK Look here for XenApp 6.5 -> http://community.citrix.com/display/xa/XenApp+6.5+PowerShell+SDK

jconger · ‎04-25-2013

Yes, this works with Presentation Server 4.5 The PowerShell scripts used for XA5 and below are really just MFCOM wrappers and MFCOM is available in all versions of XenApp/Presentation Server/Metaframe/etc.

jconger · ‎04-18-2013

Your 6.5 Farm may have local admins as a farm administrator whereas your 5.0 farm may not. This would make a difference.

jconger · ‎04-18-2013

This looks correct. Is the Splunk Windows service set to logon as a XenApp farm administrator?

jconger · ‎04-16-2013

Can you post a copy of your inputs.conf file?

jconger · ‎04-16-2013

Are you able to run the PowerShell scripts manually from the XenApp servers?

jconger · ‎03-26-2013

Are you running version 1.0.1 of the app? Some fixes were put into place to address this issue. http://splunk-base.splunk.com/apps/48390/splunk-app-for-citrix-xenapp

jconger · ‎02-07-2013

Hi saheb, Looking at the error log, I can see a runtime exception that may be caused by a divide by 0. Can you run the PowerShell script from the command prompt on your license server and post the output? It will be easier to see the correct error that way.

jconger · ‎01-22-2013

Within all that verbiage is a message (across several lines) that states: "... cannot be loaded because the execution of scripts is disabled on this system. Please see "get-help about_signing" for more details" This means that you need to set your PowerShell execution policy on your Hyper-V server. Execute the following: Set-ExecutionPolicy RemoteSigned.

jconger · ‎01-11-2013

That is strange. Do you see anything in splunkd.log that says something about skipping a stanza? Also, what version(s) of XenApp are you using?

jconger · ‎01-10-2013

Since you are able to run the PowerShell scripts manually and you are getting Windows data, it sounds like the Splunk Windows service account is not set to run as a Citrix XenApp Farm administrator. The PowerShell scripts run in the context of the service account and need to have read access to the farm.

jconger · ‎11-11-2012

Sounds like the PowerShell execution policy may not be set. Are you able to manually execute the PowerShell scripts found in the \bin\powershell folder? The alerts index is populated by saved searches based on the data in the xenapp* indexes, so no data will show up there until the other issue is corrected.

jconger · ‎10-09-2012

What happens when you run the python scripts directly (note: you will need to set your SPLUNK_HOME environment before doing this)? If the scripts produce output, then there is something going on with the forwarding.

jconger · ‎10-08-2012

Which type of OS is the TA installed on? Also, as a FYI, a new version of the TA and dashboards will be out next week.

jconger · ‎08-10-2012

Are you seeing performance information on the dashboards for your XenServer hosts or Virtual Machines? The error "Failure:['HANDLE_INVALID', 'VBD_metrics', 'OpaqueRef:...'" indicates that the XenServer API could not resolve a disk reference for a Virtual Block Device (VBD), which is not all that uncommon. The XenServer collector logs all failed attempts to SPLUNK_HOME/var/log.

jconger · ‎08-01-2012

The Python SDK is not required. The XenServer app uses Python to query the XenServer Pool Master via XenAPI (which is a web service). You will need to modify $SPLUNK_HOME/etc/apps/TA-XS60-Server/local/xsconfig.conf for your XenServer pool details.

jconger · ‎07-31-2012

Hello, You should not install the Universal Forwarder on XenServer. The Universal Forwarder should be installed on a remote machine. This remote machine can be physical or virtual. The only requirement is that the remote machine have Python 2.4 installed. You can install on *nix or Windows.

Posts	479
Solutions	93
Karma Given	5
Karma Received	227
Member Since	‎03-13-2012

Online Status	Offline
Date Last Visited	‎01-08-2026 02:27 PM

How do I debug Python code running in Splunk Enter...

Stats for variable number of CPUs

Re: Not getting any Data with Xenapp.

Re: No data to receivers

Re: XenApp Add-On and shared vDisk

Re: Splunk for Citrix XenApp Logoff times

Re: Xenapp ICA Round Trip Time possible?

Re: Issue with Splunk for Hyper-V

Re: Splunk-perfmon failing: InitQuery failed in Pe...

Re: Splunk for Citrix XenApp Logoff times

Re: XenApp 5 - no data

Re: XenApp 5 - no data

Re: XenApp 5 - no data

Re: XenApp 5 - no data

Re: XenApp 5 - no data

Re: XenApp 5 - no data

Re: User experiance and server performace data is ...

Re: getlicenseinfo.ps1 citrix xenapp licensing ser...

Re: Universal Forwarder issues following TA error ...

Re: Xenapp data not appearing but Windows is??

Re: Xenapp data not appearing but Windows is??

Re: Splunk UF inputs for XenApp

Re: TA for XenServer log errors

Re: TA for XenServer log errors

Re: splunk for Xen Server TA

Re: universal forwarder on xenserver

Re: universal forwarder on xenserver

Join the Conversation