Configure Citrix NetScaler to produce data through IPFIX or syslog

The Splunk Add-on for Citrix NetScaler supports multiple data input methods. If you are only collecting data through the modular input, which pulls data from your Citrix NetScaler devices using the NITRO API, you can skip this step.

If you want to collect data about traffic on your network, authentication activity, and web server data, collect data through IPFIX as well, as this data is not available through the NITRO REST API. You also have the option to collect authentication and network data through syslog, if you prefer.

Configure Citrix NetScaler to produce IPFIX data

1. See the Citrix NetScaler documentation on “​​Configuring the AppFlow” feature: https://docs.netscaler.com/en-us/citrix-adc/current-release/ns-ag-appflow-intro-wrapper-con/ns-ag-appflow-config-tsk.html and set your Splunk Enterprise data collection node as the collector.
2. If you have not already done so, install the Splunk Stream app on your data collection node.
3. Configure Splunk Stream to ingest IPFIX data on your Splunk Enterprise data collection node.

Configure Citrix NetScaler to produce syslog data

1. Follow the instructions to Configuring Citrix ADC appliance for audit logging to configure syslog on a Citrix NetScaler appliance. See https://docs.netscaler.com/en-us/citrix-adc/current-release/system/audit-logging/configuring-audit-logging.html/.
2. Configure the syslog input on your Splunk Enterprise data collection node.