Citrix Licensing Services Splunk Query

Find the Status of Citrix Licensing Services with Splunk

Citrix Licensing

During this exercise to get Splunk to ingest data from Citrix and make since of it we came to the Licensing server. We have ours running on a dedicated server; however,  the Splunk queries still search all hosts to keep the queries standard. Also if you ever planned on expanding your Citrix environment later you are covered. There are only 2 services that run on the license server concerned with Citrix: Citrix Licensing and CitrixWebServicesforLicensing.

These Splunk queries will give you a table with with hosts and the state of those 2 services. The dedup statement will prevent the same server from showing up more than once depending on the time frame your Splunk Universal Forwarder gathers data and the time frame your run your query for the dashboard.

index="windows" eventtype=hostmon_windows Type=Service host="*" Name="Citrix Licensing" 
StartMode="Auto" State="*" | dedup host | sort host, State | table host, State
index="windows" eventtype=hostmon_windows Type=Service host="*" Name="CitrixWebServicesforLicensing" 
StartMode="Auto" State="*" | dedup host | sort host, State | table host, State

As always please let me know what you think.

Thank you,
Logan Bingham

Author: Logan Bingham

Designing IT solutions for 20 years.

Leave a Reply