Splunk Query Finds All Citrix XenDesktop Services

Splunk Citrix Query

Splunk query to find status of Citrix XenDesktop Services

If you ever need to find all the Citrix services that run for XenDesktop in Splunk you can use this Splunk query. It will also give you the State of each service so you query if the service is running or not. I used this as the basis for many dashboards to report which Xen services are running on which servers and what is the current state.

index=”windows” eventtype=hostmon_windows Type=Service host=”*” Name=”Citrix*” OR Name=”ComTradeMPPVSAgent” OR Name=”CdfSvc” OR Name=”CtxLSPortSvc” OR Name=”CdfSvc” OR Name=”BNBOOTP” OR Name=”BNPXE” OR Name=”BNAbs” OR Name=”soapserver” OR Name=”StreamService” OR Name=”BNTFTP” OR Name=”PVSTSB” OR Name=”CtxAudioSvc” OR Name=”CtxFlashSvc” OR Name=”CtxSensVcSvc” OR Name=”MRVCSvc” OR Name=”cpsvc” OR Name=”ctxProfile” OR Name=”PvsVmAgent” OR Name=”ServicesManager” OR Name=”CtxSmartCardSvc” OR Name=”StackControlService” OR Name=”CitrixTelemetryService” StartMode=”Auto” State=”*” | sort Name, State | table host, Name, StartMode, State

How are you going to use this query?

If you modified please share the changes you made.

Author: Logan Bingham

Designing IT solutions for 20 years.

Leave a Reply