All Apps and Add-ons

Xenapp data not appearing but Windows is??

hillco
New Member

Hi

Been driving myself mad trying to get Splunk Xenapp working.
Read every article I can find but no luck so far.

Installed the universal forwarder on all Xenapp servers and the TA's on the correct boxes with the output.conf file configured.
I am getting data coming in from Windows but no Citrix data at all.

Initially seemed to be a permissioning error on the Splunk folders on both the indexer and servers which I fixed but still getting a lot of errors in the splunkd.log. Unfortunatly they are not very informative and every article I can find does not seem to have anything to do with Citrix. I read that the documentation had been updated but the only ones I can find all still refer to the older version with a TA that no longer exists.
I can run all of the Powershell scripts manually without error but even this doesnt add any data.

Here is the current error I am continually getting in the splunkd.log

01-10-2013 13:57:00.690 +0000 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xenapp_perfmon" splunk-perfmon - Perfmon - Invalid counter - \xF0\xF5\x12

All the Powershell errors I have got rid of by repermissioning the server so not sure why I am still not getting data in for Citrix.

Any ideas would be most appreiciated.

Tags (1)
0 Karma

jconger
Splunk Employee
Splunk Employee

Since you are able to run the PowerShell scripts manually and you are getting Windows data, it sounds like the Splunk Windows service account is not set to run as a Citrix XenApp Farm administrator. The PowerShell scripts run in the context of the service account and need to have read access to the farm.

0 Karma

hillco
New Member

Only Stanza entries are
2 for Parsing configuration stanza: batch:
2 for Parsing configuration stanza: monitor
and
1 No stanzas found for scheme "perfmon" in inputs.conf at script (re)start.

No mention of Xenapp and Stanza on the same line.

Servers are all Xenapp 6.5

Thanks

0 Karma

jconger
Splunk Employee
Splunk Employee

That is strange. Do you see anything in splunkd.log that says something about skipping a stanza? Also, what version(s) of XenApp are you using?

0 Karma

hillco
New Member

Thanks for the quick reply.
I was pretty sure the account had the correct rights but just to check I set it all up to use my admin account which has full admin rights on all the servers and Citrix. Still not getting any Citrix data. In the Xenapp app I get a few entries listed under Errors by Server but nothing else on any of the views.
I checked the Splunkd error log and other than a few invalid counter entries there are no other errors.
Checked the Total events indexed and index sizes. Xenapp_winevents, _perfmon and alerts are all filling up but nothing in the Xenapp index. Is this right?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...