I'm experiencing an issue with the Cisco SD-WAN application in Splunk where the dashboards are not displaying the expected data. We have followed the official documentation step by step and are successfully receiving both syslog and NetFlow data. However, it seems that the data model "Cisco_SDWAN" associated with the syslog data is not functioning correctly, which is likely causing the dashboards to fail. We've already performed extensive troubleshooting without success. Has anyone encountered a similar issue or can offer guidance on resolving the data model problem? Splunk Enterprise Security  Cisco Catalyst SD-WAN App for Splunk  and Cisco Catalyst SD-WAN Add-on for Splunk  ... View more

Hi everyone, I’m new to working with Citrix NetScaler and need assistance with integrating it into Splunk Enterprise. Could someone please guide me on: The prerequisites required for this integration. The exact steps to follow for a successful setup and comprehensive data coverage. Any detailed insights or documentation links would be greatly appreciated. and please let me know when it required to use Splunk dashboards or visualization apps for NetScaler data   Thank you! Splunk Add-on for Citrix NetScaler  ... View more

Hi Splunk Community, I’m new to integrating Citrix NetScaler with Splunk, but I have about 9 years of experience working with Splunk. I need your guidance on how to successfully set up this integration to ensure that: All data from NetScaler is ingested and extracted correctly. The dashboards in the Splunk App for Citrix NetScaler display the expected panels and trends. Currently, I have a 3-machine Splunk environment (forwarder, indexer, and search head). Here's what I’ve done so far: I installed the Splunk App for Citrix NetScaler on the search head. Data is being ingested from the NetScaler server via the heavy forwarder, but I have not installed the Splunk Add-on for Citrix NetScaler on the forwarder or indexer. Despite this, the dashboards in the app show no data. From your experience, is it necessary to install the Splunk Add-on for Citrix NetScaler on the heavy forwarder (or elsewhere) to extract and normalize the data properly? If so, would that resolve the issue of empty dashboards? Any insights or steps to troubleshoot and ensure proper integration would be greatly appreciated! Thanks in advance!     ... View more

We are experiencing issues configuring RADIUS authentication within Splunk. Despite following all required steps and configurations, authentication via RADIUS is not working as expected, and users are unable to authenticate through the RADIUS server. - Installed radius client on splunk machine and configure the radiusclient.conf file with radius server data - Updated the authentication.conf file located in $SPLUNK_HOME/etc/system/local/, as well as updates to web.confto support RADIUS authentication requests in Splunk Web. - Used the radtest tool to validate the connection between the Splunk RADIUS client - Monitored the Splunk authentication logs in $SPLUNK_HOME/var/log/splunk/splunkd.log to identify any errors, and consistently encountered the following error: Could not find [externalTwoFactorAuthSettings] in authentication stanza. - Integrated radiusScripted.py to assist with RADIUS authentication, configuring it to work with the authentication settings. It appears that Splunk is unable to successfully authenticate with the RADIUS server, with repeated errors indicating missing configuration stanzas or settings that are not recognized. Environment Details: Splunk Version: 9.1.5 Authentication Configuration Files: authentication.conf, web.conf Additional Scripts: radiusScripted.py Please advise on troubleshooting steps or configuration adjustments needed to resolve this issue. Any insights or documentation on RADIUS integration best practices with Splunk would be highly appreciated. thanks    ... View more