Hi
Been driving myself mad trying to get Splunk Xenapp working.
Read every article I can find but no luck so far.
Installed the universal forwarder on all Xenapp servers and the TA's on the correct boxes with the output.conf file configured.
I am getting data coming in from Windows but no Citrix data at all.
Initially seemed to be a permissioning error on the Splunk folders on both the indexer and servers which I fixed but still getting a lot of errors in the splunkd.log. Unfortunatly they are not very informative and every article I can find does not seem to have anything to do with Citrix. I read that the documentation had been updated but the only ones I can find all still refer to the older version with a TA that no longer exists.
I can run all of the Powershell scripts manually without error but even this doesnt add any data.
Here is the current error I am continually getting in the splunkd.log
01-10-2013 13:57:00.690 +0000 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xenapp_perfmon" splunk-perfmon - Perfmon - Invalid counter - \xF0\xF5\x12
All the Powershell errors I have got rid of by repermissioning the server so not sure why I am still not getting data in for Citrix.
Any ideas would be most appreiciated.
Since you are able to run the PowerShell scripts manually and you are getting Windows data, it sounds like the Splunk Windows service account is not set to run as a Citrix XenApp Farm administrator. The PowerShell scripts run in the context of the service account and need to have read access to the farm.
Only Stanza entries are
2 for Parsing configuration stanza: batch:
2 for Parsing configuration stanza: monitor
and
1 No stanzas found for scheme "perfmon" in inputs.conf at script (re)start.
No mention of Xenapp and Stanza on the same line.
Servers are all Xenapp 6.5
Thanks
That is strange. Do you see anything in splunkd.log that says something about skipping a stanza? Also, what version(s) of XenApp are you using?
Thanks for the quick reply.
I was pretty sure the account had the correct rights but just to check I set it all up to use my admin account which has full admin rights on all the servers and Citrix. Still not getting any Citrix data. In the Xenapp app I get a few entries listed under Errors by Server but nothing else on any of the views.
I checked the Splunkd error log and other than a few invalid counter entries there are no other errors.
Checked the Total events indexed and index sizes. Xenapp_winevents, _perfmon and alerts are all filling up but nothing in the Xenapp index. Is this right?