Splunk Query Determine NetScaler Load Balanced VIP Status

Determine the status of an individual Load Balanced Service with this Splunk query

When you have your Netscaler load-balancing traffic for a service Splunk is a great way to monitor and report on the status of the load balanced VIP. Now we are talking about the the load balanced VIP resource that is per VIP, not per service or service group.
Netscaler Load Balancing


The index is the index you are using for netscaler data.

The source is stat:lbserver and the sourcetype is citrix:netscaler:nitro.

The name of the load balanced VIP is the name to look for using this query.

There are a few fields that you can call depending if you want a binary or text result returned. Which one is up to you and can determine that type of visualization you can use.

For binary status of the load balanced VIP use avl:status or citrix_netscaler_avl_status they give you “0” or “1”

For text status of the load balanced VIP use avl_status_string and citrix_netscaler_state they give you “UP” or “DOWN”

I hope this helps to create reports that not generated by Citrix products but by Splunk. If you make a cool report or chart in Splunk let me know in the comments.

The data that the query looks for is captured using the Splunk Add-on for Citrix NetScaler which is a Splunk supported Add-on so you can get support for it if you have a valid support contract. I know that having the vendor provide support sometimes makes a difference when it comes to choosing the add-ons you use in your Splunk environment. Here is the link to the Splunk Add-on for Citrix NetScaler docs if you want to have a look.

Thank you,

Logan Bingham

Author: Logan Bingham

Designing IT solutions for 20 years.

Leave a Reply