Vendor - Citrix¶
Product - Netscaler ADC/SDX¶
Ref | Link |
---|---|
Splunk Add-on | https://splunkbase.splunk.com/app/2770/ |
Product Manual | https://docs.citrix.com/en-us/citrix-adc/12-1/system/audit-logging/configuring-audit-logging.html |
Sourcetypes¶
sourcetype | notes |
---|---|
citrix:netscaler:syslog | None |
Sourcetype and Index Configuration¶
key | sourcetype | index | notes |
---|---|---|---|
citrix_netscaler | citrix:netscaler:syslog | netfw | none |
Filter type¶
MSG Parse: This filter parses message content
Setup and Configuration¶
- Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
- Review and update the splunk_metadata.csv file and set the index and sourcetype as required for the data source.
- Follow vendor configuration steps per Product Manual above. Ensure the data format selected is “DDMMYYYY”
Options¶
Variable | default | description |
---|---|---|
SC4S_LISTEN_CITRIX_NETSCALER_TCP_PORT | empty string | Enable a TCP port for this specific vendor product using the port number defined |
SC4S_LISTEN_CITRIX_NETSCALER_UDP_PORT | empty string | Enable a UDP port for this specific vendor product using the port number defined |
SC4S_DEST_CITRIX_NETSCALER_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source |
Verification¶
Use the following search to validate events are present
index=<asconfigured> sourcetype=cp_log
Verify timestamp, and host values match as expected