Xenapp data not appearing but Windows is??

[hillco]

Hi

Been driving myself mad trying to get Splunk Xenapp working.
Read every article I can find but no luck so far.

Installed the universal forwarder on all Xenapp servers and the TA's on the correct boxes with the output.conf file configured.
I am getting data coming in from Windows but no Citrix data at all.

Initially seemed to be a permissioning error on the Splunk folders on both the indexer and servers which I fixed but still getting a lot of errors in the splunkd.log. Unfortunatly they are not very informative and every article I can find does not seem to have anything to do with Citrix. I read that the documentation had been updated but the only ones I can find all still refer to the older version with a TA that no longer exists.
I can run all of the Powershell scripts manually without error but even this doesnt add any data.

Here is the current error I am continually getting in the splunkd.log

01-10-2013 13:57:00.690 +0000 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-perfmon.exe" -index xenapp_perfmon" splunk-perfmon - Perfmon - Invalid counter - \xF0\xF5\x12

All the Powershell errors I have got rid of by repermissioning the server so not sure why I am still not getting data in for Citrix.

Any ideas would be most appreiciated.

[jconger]

Since you are able to run the PowerShell scripts manually and you are getting Windows data, it sounds like the Splunk Windows service account is not set to run as a Citrix XenApp Farm administrator. The PowerShell scripts run in the context of the service account and need to have read access to the farm.

[hillco]

Only Stanza entries are
2 for Parsing configuration stanza: batch:
2 for Parsing configuration stanza: monitor
and
1 No stanzas found for scheme "perfmon" in inputs.conf at script (re)start.

No mention of Xenapp and Stanza on the same line.

Servers are all Xenapp 6.5

Thanks

[jconger]

That is strange. Do you see anything in splunkd.log that says something about skipping a stanza? Also, what version(s) of XenApp are you using?

[hillco]

Thanks for the quick reply.
I was pretty sure the account had the correct rights but just to check I set it all up to use my admin account which has full admin rights on all the servers and Citrix. Still not getting any Citrix data. In the Xenapp app I get a few entries listed under Errors by Server but nothing else on any of the views.
I checked the Splunkd error log and other than a few invalid counter entries there are no other errors.
Checked the Total events indexed and index sizes. Xenapp_winevents, _perfmon and alerts are all filling up but nothing in the Xenapp index. Is this right?