ADC

Export metrics directly from NetScaler to Splunk

October 6, 2024

Contributed by:

C C

NetScaler now supports direct export of metrics to Splunk in the JSON format. NetScaler provides rich metrics to monitor your application health and application security health. By exporting the metrics provided by NetScaler to Splunk, you can visualize the metrics and get meaningful insights.

Configure exporting metrics directly from NetScaler to Splunk

To configure the export of metrics you must perform the following steps:

Configure an HTTP event collector (HEC) on Splunk.
Create a service for Splunk on NetScaler.
Create a time series analytics profile for direct export of metrics to Splunk.

Configure an HTTP event collector on Splunk

You can forward metrics to Splunk by configuring an HTTP event collector. Configuring the HTTP event collector involves creating an authentication token and associating a metric index with the token where metrics are sent, and setting the HTTP port number.

See the Splunk documentation for information on how to configure the HTTP event collector.

Once you have configured the HTTP event collector, copy the authentication token and save it for reference. You need to specify this token while configuring the analytics profile on NetScaler.

Create a collector service for Splunk on NetScaler

You can create a collector service on NetScaler to collect and export metrics from NetScaler to Splunk. Do the following to create a collector service for Splunk.

add service <collector> <splunk-server-ip-address> <protocol> <port>

Example:

add service splunk_service 10.102.34.155 HTTP 8088

In this configuration:

ip-address: Specify the Splunk server IP address.
collector-name: Specify the collector.
protocol: Specify the protocol as HTTP or HTTPS
port: Specify the port number of the Splunk HTTP event collector.

Configure a time series analytics profile on NetScaler

Do the following to create a time series analytic profile on NetScaler. While creating the time series profile, enable the option for metrics collection and specify details such as Splunk authentication token, name of the collector, output mode, and URL. By default, the time series analytics data is exported every 30 seconds but you can configure it in the range of 30–300 seconds using the metrics frequency parameter.

Create a time series analytics profile.
```
add analytics profile <profile-name> -type timeseries -metrics enabled  -outputMode json -collectors <collector-name>  -analyticsAuthToken <"auth-token"> -analyticsEndpointUrl <endpoint-url>
```
In this configuration, auth_token must be configured as “Splunk <auth token generated in Splunk HTTP event collector>”.

Example:
```
    add analytics profile splunk_profile -type timeseries -metrics enabled -outputMode json -collectors splunk_service -analyticsAuthToken "Splunk 1234-5678-12345" -analyticsEndpointUrl /services/collector
```
In this configuration:
- metrics: Specify the value as enabled to enable metrics collection.
- collectors: Specify the collector service created for Splunk.
- analyticsAuthToken: Specify the authentication token to be included in the authorization header while sending metrics to Splunk. The format is “Splunk auth-token”. Here, auth-token is the authentication token created on the Splunk server while configuring the HTTP event collector.
- analyticsEndpointUrl : Configure this value as /services/collector to send metrics to the default index associated with the configured auth token. To redirect metrics to a specific index, specify the index name in the URL (/services/collector?index=).
Note:

You can modify the time series analytics profile parameters using the set analytics profile command.

Verify the analytics profile configuration using the show analytics profile command.

# show analytics profile splunk_profile

1)   Name: splunk_profile
    Collector: splunk_service
    Profile-type: timeseries
        Output Mode: json
        Metrics: ENABLED
        Schema File: schema.json
        Metrics Export Frequency: 30
        Events: DISABLED
        Auditlog: DISABLED
        Serve mode: Push
    Authentication Token: <auth-token>
    Endpoint URL: /services/collector
    Endpoint Content-type:
    Endpoint Metadata:
    Reference Count: 0

Once the configuration is successful, metrics are sent as HTTP payloads to Splunk and you can view it on the Splunk application user interface.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Export metrics directly from NetScaler to Splunk

October 6, 2024

Contributed by:

C C

October 6, 2024

Contributed by:

C C

Export metrics directly from NetScaler to Splunk

Configure exporting metrics directly from NetScaler to Splunk

Configure an HTTP event collector on Splunk

Create a collector service for Splunk on NetScaler

Configure a time series analytics profile on NetScaler

In this article