Product Documentation
Application Delivery Management
14.1 - Current Release 13.1 13.0 12.1
View PDF

Integration with Splunk

February 16, 2024
Contributed by: 
R C

You can now integrate NetScaler Console with Splunk to view analytics for:

  • WAF violations

  • Bot violations

  • SSL Certificate Insights

  • Gateway insights

  • Events and metrics

Splunk add-on enables you to:

  • Combine all other external data sources.

  • Provide greater visibility of analytics in a centralized place.

NetScaler Console collects Bot, WAF, SSL events, and sends to Splunk periodically. The Splunk Common Information Model (CIM) add-on converts the events to CIM compatible data. As an administrator, using the CIM compatible data, you can view the events in the Splunk dashboard.

For a successful integration, you must:

Configure Splunk to receive data from NetScaler Console on-prem

In Splunk, you must:

  1. Setup the Splunk HTTP event collector endpoint and generate a token

  2. Install the Splunk Common Information Model (CIM) add-on

  3. Install the CIM normalizer (applicable only for WAF and bot insights)

  4. Prepare a sample dashboard in Splunk

Setup the Splunk HTTP event collector endpoint and generate a token

You must first setup the HTTP event collector in Splunk. This setup enables the integration between the NetScaler Console and Splunk to send the data. Next, you must generate a token in Splunk to:

  • Enable authentication between NetScaler Console and Splunk.

  • Receive data through the event collector endpoint.

  1. Log on to Splunk.

  2. Navigate to Settings > Data Inputs > HTTP event collector and click Add new.

  3. Specify the following parameters:

    1. Name: Specify a name of your choice.

    2. Source name override (optional): If you set a value, it overrides the source value for HTTP event collector.

    3. Description (optional): Specify a description.

    4. Output Group (optional): By default, this option is selected as None.

    5. Enable indexer acknowledgement: By default, this option is not selected.

      Event collector parameters

  4. Click Next.

  5. Optionally, you can set additional input parameters in the Input Settings page.

  6. Click Review to verify the entries and then click Submit.

    A token gets generated. You must use this token when you add details in NetScaler Console.

    Splunk token

Install the Splunk Common Information Model

In Splunk, you must install the Splunk CIM add-on. This add-on ensures that the data received from NetScaler Console to normalize the ingested data and match a common standard using the same field names and event tags for equivalent events.

  1. Log on to Splunk.

  2. Navigate to Apps > Find More Apps.

    Splunk find more apps

  3. Type CIM in the search bar and press Enter to get the Splunk Common Information Model (CIM) add-on, and click Install.

    Splunk CIM

Install the CIM normalizer

The CIM normalizer is an additional plug-in that you must install to view the WAF and bot insights in Splunk.

  1. In the Splunk portal, navigate to Apps > Find More Apps.

    Splunk find more apps

  2. Type CIM normalization for NetScaler Console service events/data in the search bar and press Enter to get the add-on, and click Install.

    CIM normalizer

Prepare a sample dashboard in Splunk

After you install the Splunk CIM, you must prepare a sample dashboard using a template for WAF and Bot, SSL Certificate insights, and events and metrics. You can download the dashboard template (.tgz) file, use any editor (for example, notepad) to copy its contents, and create a dashboard by pasting the data in Splunk.

Note:

The following procedure to create a sample dashboard is applicable for all use cases. You must use the required json file.

  1. Log on to Citrix downloads page and download the sample dashboard available under Sample Dashboards for 3rd party Endpoints.

  2. Extract the file, open the json file using any editor, and copy the data from the file.

    After you extract, you get three json files. Use the:

    • adm_splunk_security_violations.json file to create WAF and Bot sample dashboard.

    • adm_splunk_ssl_certificate.json file to create SSL certificate insight sample dashboard.

    • adm_splunk_events_and_metrics_history.json file to create NetScaler Console events and metrics dashboard.

  3. In the Splunk portal, navigate to Search & Reporting > Dashboards and then click Create New Dashboard.

    Create dashboard

  4. In the Create New Dashboard page, specify the following parameters:

    1. Dashboard Title - Provide a title of your choice.

    2. Description - Optionally, you can provide a description for your reference.

    3. Permission - Select Private or Shared in App based on your requirement.

    4. Select Dashboard Studio.

    5. Select any one layout (Absolute or Grid), and then click Create.

      Dashboard parameters

      After you click Create, select the Source icon from the layout.

      Source layout

  5. Delete the existing data, paste the data that you copied in step 2, and click Back.

  6. Click Save.

    You can view the sample dashboard.

    The following is an example sample dashboard for WAF and bot.

    Sample dashboard

Configure NetScaler Console on-prem to export data to Splunk

You now have everything ready in Splunk. The final step is to configure NetScaler Console by creating a subscription and adding the token.

Upon completion of the following procedure, you can view the updated dashboard in Splunk that is currently available in your NetScaler Console:

  1. Log on to NetScaler Console.

  2. Navigate to Settings > Ecosystem Integration.

  3. In the Subscriptions page, click Add.

  4. Specify a name of your choice in the Subscription Name field.

  5. In the Select Feature tab, you can select the features that you want to export and click Next.

    • Realtime Export - The selected violations are exported to Splunk immediately.

    • Periodic Export - The selected violations are exported to Splunk based on the duration you select.

      Select features

  6. In the Select Instance tab, you can either choose Select All Instances or Custom select, and then click Next.

    • Select All Instances - Exports data to Splunk from all the NetScaler instances.

    • Custom select - Enables you to select the NetScaler instances from the list. If you select specific instances from the list, then the data is exported to Splunk only from the selected NetScaler instances.

      Select instances

  7. In the Subscription Setting tab:

    1. End Point Type – Select Splunk.

    2. End Point URL – Specify the Splunk end point details. The end point must be in the https://SPLUNK_PUBLIC_IP:SPLUNK_HEC_PORT/services/collector/event format.

      Note

      It is recommended to use HTTPS for security reasons.

      • SPLUNK_PUBLIC_IP – A valid IP address configured for Splunk.

      • SPLUNK_HEC_PORT – Denotes the port number that you have specified during the HTTP event endpoint configuration. The default port number is 8088.

      • Services/collector/event – Denotes the path for the HEC application.

    3. Authentication token – Copy and paste the authentication token from the Splunk page.

    4. Select Frequency - Select Daily or Hourly from the list. Based on the selection, NetScaler Console exports the details to Splunk.

      Note

      Applicable only if you have selected violations in Periodic Export.

    5. Click Submit.

      Subscribe

      Note

      • When you configure with Periodic Export option for the first time, the selected features data get pushed to Splunk immediately. The next export frequency happens based on your selection (daily or hourly).

      • When you configure with Realtime Export option for the first time, the selected features data pushed to Splunk immediately as soon as the violations are detected in NetScaler Console.

View dashboards in Splunk

After you complete the configuration in NetScaler Console, the data gets exported from NetScaler Console and the events appear in Splunk.

You are all set to view the updated dashboard in Splunk without any additional steps.

Go to Splunk and click the dashboard that you have created to view the updated dashboard.

The following is an example for the updated WAF and Bot dashboard:

Updated dashboard

The following dashboard is an example for the updated SSL Certificate insights dashboard.

SSL certificate

The following dashboard is an example for the updated events and metrics dashboard.

Note:

The usage data for Memory, CPU, and Disk shows the current value from the NetScaler Console. The up and down trend of these values are shown based on the comparison of the previous value for every 5 minutes.

Events dashboard

Apart from dashboard, you can also view data in Splunk after creating the subscription.

  1. In Splunk, click Search & Reporting.

  2. In the search bar:

    • Type sourcetype="metrics" and select the duration from the list to view the NetScaler Console metrics data.

    • Type sourcetype="event" and select the duration from the list to view the NetScaler Console events data.

    • Type sourcetype="bot" or sourcetype="waf" and select the duration from the list to view bot/WAF data.

    • Type sourcetype="ssl" and select the duration from the list to view the SSL certificate insights data.

    • Type sourcetype="gateway_insights" and select the duration from the list to view the Gateway insights data.

Integration with Splunk
February 16, 2024
Contributed by: 
R C
February 16, 2024
Contributed by: 
R C

In this article

Site feedback | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.