Product Documentation
ADC
14.1-Current Release 13.1 12.1
View PDF

Export audit logs and events directly from NetScaler to Splunk

May 28, 2025
Contributed by: 
C

Audit logging enables you to log the NetScaler states and status information collected by various modules in NetScaler. By reviewing the logs, you can troubleshoot problems or errors and fix them.

You can now export audit logs and events from NetScaler to industry standard log aggregator platforms such as Splunk and get meaningful insights.

There are multiple ways to export audit logs from NetScaler to Splunk. You can either configure Splunk as a syslog server or as an HTTP server. This topic provides information on configuring Splunk as an HTTP server using the Splunk HTTP event collector. Using the HTTP event collector you can send audit logs over HTTP (or HTTPS or SSL) directly to the Splunk platform from your NetScaler.

Starting with NetScaler release 14.1-47.x, you have a simplified and flexible way to export audit logs in JSON format directly to Splunk’s HTTP Event Collector (HEC). The configuration to export audit logs is now available under add syslogaction command. Prior to NetScaler release 14.1-47.x, the configuration was part of a time series analytics profile.

Integrating JSON log exports into syslogaction, allows better control over log filtering using existing syslog policies, ensuring that only relevant logs are sent to Splunk HEC.

The key benefits are as follows:

  • Easily manageable - As JSON log export is decoupled from the analytics profile, it can be managed separately by using syslogAction.
  • Granular Control - You can use syslogaction’s filtering capabilities to selectively export logs.
  • Streamlined Configuration - The process is simpler and reduces the complexity of setup.
  • Secure Transmission - Supports both HTTP and HTTPS transport for Splunk integration and therefore secure.

Note:

Audit log export in JSON format by using analytics profile is deprecated. As an alternative, configure audit log export in JSON format by using syslogAction for better flexibility and control.

Configure exporting audit logs from NetScaler to Splunk

To configure the export of audit logs you must perform the following steps:

  1. Configure the HTTP event collector on Splunk.

  2. If you are on NetScaler release 14.1-43.x or earlier, configure time series analytics profile on NetScaler.

    or

    If you are on NetScaler release 14.1-47.x or later, configure export by using the syslogAction.

Configure HTTP event collector on Splunk

You can forward audit logs to Splunk by configuring an HTTP event collector. Configuring the HTTP event collector involves creating an authentication token and associating an event index with the token where events are sent, and setting the HTTP port number.

See the Splunk documentation for information on how to configure the HTTP event collector.

Once you have configured the HTTP event collector, copy the authentication token and save it for reference. You need to specify this token while configuring the analytics profile on NetScaler.

Configure time series analytics profile on NetScaler

Do the following to export NetScaler audit logs to Splunk.

  1. Create a collector service for Splunk.

    add service <service-name> <splunk-server-ip-address> <protocol> <port>

    Example:

    add service splunk_service 10.102.34.155 HTTP 8088

    In this configuration:

    • ip-address: Specify the Splunk server IP address.
    • service-name: Specify a name for the collector service.
    • protocol: Specify the protocol as HTTP or HTTPS (Configure SSL).
    • port: Specify the port number.

  2. Create a time series analytics profile.

        add analytics profile <profile-name> -type timeseries -auditlogs enabled -collectors <collector-name> -analyticsAuthToken <"auth-token">
    -analyticsEndpointContentType <"application/json"> -analyticsEndpointMetadata <"meta-data-for-endpoint:"> -analyticsEndpointUrl <"endpoint-url">

    Example:

        add analytics profile audit_profile -type timeseries -auditlogs enabled -collectors splunk_service -analyticsAuthToken "Splunk 1234-5678-12345" -analyticsEndpointContentType "application/json" -analyticsEndpointMetadata "{\"event\":[" -analyticsEndpointUrl "/services/collector/event"

    In this configuration:

    • auditlogs: Specify the value as enabled to enable audit logging.
    • collectors: Specify the collector service created for Splunk. For example, “splunk_service” is the collector service created in step 1.

    • analyticsAuthToken: Specify the authentication token to be included in the authorization header while sending logs to Splunk. This token is the authentication token created on the Splunk server while configuring the HTTP event collector. The authentication token must be in the format “Splunk <token-copied-from-splunk>”. For example, “Splunk 3e52aa4b-1db7-45b2-9af9-173eedc8e1bc”.

    • analyticsEndpointContentType: Specify the format of the logs.

    • analyticsEndpointMetadata: Specify the meta data that Splunk expects at the start of the data, which is "{\"event\":[".

    • analyticsEndpointUrl: Specify the URL to which you have configured Splunk HEC to get requests to. For example, “/services/collector/event”.

    Note:

    You can modify the time series analytics profile parameters using the set analytics profile command.

  3. Verify the analytics profile configuration using the show analytics profile command.

    # show analytics profile audit_profile

1)    Name: audit_profile
      Collector: splunk
      Profile-type: timeseries
            Output Mode: avro
            Metrics: DISABLED
              Schema File: schema.json
              Metrics Export Frequency: 30
            Events: DISABLED
            Auditlog: ENABLED
            Serve mode: Push
       Authentication Token: <auth-token>
       Endpoint URL: /services/collector/event
       Endpoint Content-type: application/json
       Endpoint Metadata: {"event":[
       Reference Count: 0

Once the configuration is successful, the audit logs are sent as HTTP payloads to Splunk and you can view it on the Splunk application user interface.

Configure export of audit logs in JSON format by using syslogaction

You can configure export of audit logs in JSON format by using syslogaction through CLI and GUI.

Configure export of audit logs in JSON format by using syslogaction through CLI

If you are on NetScaler release 14.1-47.x or later, perform the following steps:

  1. Create a syslog action for Splunk.

    add audit syslogAction <action_name> <splunk-server-ip> -serverPort <server_port> -transport HTTP -loglevel <loglevel> -httpauthToken "<auth-token>" -httpendpointUrl "<endpoint-url>"

    Example:

    add audit syslogAction http_sys_act1 10.102.44.90 -serverPort 8088 -transport HTTP -loglevel ALL -httpauthToken "Splunk 1234-5678-12345" -httpendpointUrl "/services/collector/event"

    In this configuration:

    • splunk-server-ip: The IP address of the Splunk HEC server.
    • server-port: The port on which HEC is is run (default 8088).
    • transport: Set as HTTP for Splunk integration.
    • httpauthToken: Specify the authentication token to be included in the authorization header while sending logs to Splunk. This token is the authentication token created on the Splunk server while configuring the HTTP event collector. The authentication token must be in the format “Splunk ”. For example, “Splunk 3e52aa4b-1db7-45b2-9af9-173eedc8e1bc”.
    • httpendpointUrl: Specify the URL to which you have configured Splunk HEC to get requests to. For example, “/services/collector/event”.

  2. Verify the syslog action.

    show audit syslogAction <name>

    Example:

    show audit syslogAction http_sys_act1 
    Name: http_sys_act1 
        Server IP: 10.102.44.90
        Port: 8088 
        Loglevel : EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL DEBUG 
        Managementlog: NONE 
        Managementloglevel: EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL 
        Date Format: MMDDYYYY 
        Time Zone: GMT_TIME 
        Facility: LOCAL0 
        Tcp Logging: NONE 
        ACL Logging: DISABLED 
        LSN Logging: DISABLED 
        ALG Logging: DISABLED 
        Subscriber Logging: DISABLED 
        DNS Logging: DISABLED 
        ContentInspection Log: DISABLED 
        Transport: HTTP 
        HttpAuthToken: <auth-token>
        HttpEndpointUrl: /services/collector/event 
        UserDefinedLogging: NO 
        AppFlow export: DISABLED 
        SSL Interception: DISABLED 
        URL Filtering: DISABLED 
        StreamAnalytics: DISABLED

  3. Add and bind a syslog policy.

    add audit syslogPolicy <name> <rule> <action>
bind audit syslogGlobal <policyName> [-globalBindType <globalBindType>]

    Example:

    add audit syslogPolicy http_sys_pol1 true http_sys_act1
bind audit syslogGlobal -policyName http_sys_pol1 -priority 11

After successful configuration, audit logs are sent as HTTP payloads to Splunk HEC and are visible in the Splunk UI.

Notes:

  • You can modify the syslog action using the following command: set syslogAction <action_name>.
  • Management logs export from NetScaler is not available in the syslog CLI when using the HTTP transport type.

Configure export of audit logs in JSON format by using syslogaction through GUI

  1. Navigate to Configuration > System > Auditing > Syslog.
  2. Select the Servers tab.
  3. Click Add.
  4. In the Create Auditing Server page, select Transport Type as HTTP.
  5. Add HTTP Authentication Token, HTTP Endpoint URL, populate other relevant fields, and click Create.
  6. To add the policy, select the Policies tab, and click Add.
  7. On the Create Auditing Syslog Policy page, provide a name, select an expression type, select the server, and click Create.
  8. To bind the policy globally, on the Syslog Auditing page, select a policy, right-click on the selected syslog audit policy, and click Advanced Policy Global Bindings.
  9. Select the policy and click Done.

Audit logs JSON export by using syslogaction through GUI

Configure exporting events from NetScaler to Splunk

To configure the export of events from NetScaler to Splunk, you must perform the following steps:

  1. Configure the HTTP event collector on Splunk following the steps in Configure HTTP event collector on Splunk.

  2. Create a collector service on NetScaler by using the following command.

    add service <collector> <splunk-server-ip-address> <protocol> <port>

    Example:

    add service splunk_service 10.102.34.155 HTTP 8088

    In this configuration:

    • ip-address: Specify the Splunk server IP address.
    • collector-name: Specify the collector.
    • protocol: Specify the protocol as HTTP or HTTPS (Configure SSL).
    • port: Specify the port number.

  3. Create a time series analytics profile on NetScaler using the add analytics profile command. You must specify the -events enabled option while creating the analytics profile to enable the export events.

    Example:

    add analytics profile event_profile -type timeseries -events enabled -collectors splunk -analyticsAuthToken "Splunk 1234-5678-12345" -analyticsEndpointContentType "application/json" -analyticsEndpointMetadata "{\"event\":[" -analyticsEndpointUrl "/services/collector/event"

  4. Verify the analytics profile configuration using the show analytics profile command.

    # show analytics profile event_profile

1)    Name: event_profile
      Collector: splunk
      Profile-type: timeseries
            Output Mode: avro
            Metrics: DISABLED
              Schema File: schema.json
              Metrics Export Frequency: 30
            Events: ENABLED
            Auditlog: DISABLED
            Serve mode: Push
       Authentication Token: <auth-token>
       Endpoint URL: /services/collector/event
       Endpoint Content-type: application/json
       Endpoint Metadata: {"event":[
       Reference Count: 0

Configuration example

You can export audit logs and events directly from NetScaler to Splunk using a single analytics profile.

add service splunk_service 10.102.34.155 HTTP 8088

add analytics profile splunk_profile -type timeseries -auditlogs enabled -events enabled -collectors splunk_service -analyticsAuthToken "Splunk 1234-5678-12345" -analyticsEndpointContentType "application/json" -analyticsEndpointMetadata "{\"event\":[" -analyticsEndpointUrl "/services/collector/event"

The show analytics profile displays the following output:

1)    Name: splunk_profile
      Collector: splunk
      Profile-type: timeseries
            Output Mode: avro
            Metrics: DISABLED
              Schema File: schema.json
              Metrics Export Frequency: 30
            Events: ENABLED
            Auditlog: ENABLED
            Serve mode: Push
       Authentication Token: <auth-token>
       Endpoint URL: /services/collector/event
       Endpoint Content-type: application/json

The following is an example for exporting audit logs in JSON format by using the add syslogaction command.

Export audit logs and events directly from NetScaler to Splunk
May 28, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999-2025 Cloud Software Group, Inc. All rights reserved.