There is a solution for Splunk > 7.2 : INGEST_EVAL props.conf   [json-github] ... DATETIME_CONFIG = CURRENT TRANSFORMS-get-date = construct_date   transforms.conf   [construct_date] INGEST_EVAL=_time=strptime(substr(_raw,17,20),"%Y-%m-%dT%H:%M:%SZ")     This works for HEC-event and HEC-raw endpoint!   For further information look at: https://conf.splunk.com/files/2020/slides/PLA1154C.pdf ... View more

Hey, it looks like a permission issue: Go to "Manage Apps" and find the "Splunk Add-On for Citrix NetScaler", then click on "Permissions" and below change it from "This app only" to "All apps" ... View more