This message was deleted.

Sending the whole payload over regular syslog may be a sticking point given protocol limitations. , ADM uses Logstream and NSWL uses its own protocol I believe (haven't had a use case for that before). v13 has the ability to mirror decrypted traffic somewhere else, typically used for IDS/IPS deployments, but i'm not sure how Splunk ingest would work. I don't know if the Splunk NetScaler app has the ability to get that data but it may be worth reaching out to them to see.

Thanks. I found some documentation from splunk which seems up to date. https://docs.splunk.com/Documentation/AddOns/released/CitrixNetScaler/Setup#Configure_Citrix_NetScaler_to_produce_IPFIX_data The Splunk App For Stream can receive IPFIX-data so we're gonna give it a shot.