Hello,
I have a NetScaler in my environment setup to send the Syslog files to Splunk 6.2. It's configured to send "all" of the events available. I can modify this later but I just want to see the data flow through into Splunk.
Currently when I look at the Splunk web console with the NetScaler App installed all I see is the "SSLLOG SSL_HANDSHAKE_SUCCESS" events. I would think it would send me everything that I included under all such as 'error', 'critical', 'emergency', 'warning'....
Any thoughts?
Thank you,
Luke
This can be closed out. I got it resolved. The handshakes show up because it's a ton of info. But if you actually start filtering things out you see a ton of information.
Sorry for the waste of time. I am new to a lot of this stuff.
Hi Lou,
What App did you use for this. We are running on 10.5 version of NS and want to use an app to get field extractions in Splunk. However, the app I found online works only with 9.X release of NS. Appreciate your answer.