Hello splunkers!
I recently discovered a problem with guys monitoring citrix activities on how published app names are written.
The problem concerns application names which can have different format, like upper case and lower case.
Within dashboards this is not a problem as the value "SessionPublishedAppsCtx" is changed in "SessionPublishedAppsCtxSplitLower".
However, for a lot of applications, for ex. google chrome, I get results with the SessionPublishedAppsCtx=google_chrome_1-1.
It seems that somewhere, the application name is feeded with numbers at its end, or even sometimes truncated (off for 'office')
When I checked the brut logs from splunk SHD, I can see that logs are received in this format from uber Agent, which drive me to think that such name modification are done on the uberagent itself.
Any idea or feedback from this little issue ?
Thanks in advance
Cheers!
↧