Missing data


I read and used the steps mentioned in Dashboards Have Only Partial or No Data but I am not able to resolve an issue where I am missing at least Session Details. I have two endpoints in uberAgent. Server1 is missing some of the data and Server2 has all of the expected data. The servers are behind different firewalls and I confirmed port 19500 is open to the Splunk host.

Windows 2008R2 endpoint servers. Splunk 6.3 and uberAgent 3.6.

Any suggestions please?

I appreciate your support on the issue and you have a great product.


Thank you 


After digging into this further, I am experiencing missing data on both of the servers. When I view Sessions -> User Sessions, I am missing users and I am comparing this with AppCenter where I have ten users active but the uberAgent User Sessions has two users listed. I checked the log files on the two XA servers where the uberAgent service is running and I see the missing users listed in the log. I am setup as standalone which is recommended. The Splunk server and the XA servers are all 2008 R2 servers.


I checked the KB article and I do not see the error in the log. I also checked for ReceiverStatistics and it is not in the log. I am assuming the only log is on the endpoints because I do not see one on the Splunk server.


The data is complete if the user is listed in User Sessions and the issue is that I am missing users. The users that are listed are not missing data. I also noticed that the missing users have logged into a XA session recently. For example, uberAgent displays the logon times from 8:07 and earlier but not the users that logged in after 8:07. I have 4 users that logged in after 8:07 and they are not in User Sessions and it was 8:40 when I noticed this. 

Any suggestions?



I appreciate your assistance.




  • Avatar
    Helge Klein Official comment

    Let me summarize:

    You have two servers with uberAgent endpoints installed. Looking at the session detail dashboard, you are missing part of the data from server1; data from server2 is complete.

    Is that correct?

    What server1 data are you missing in the session detail dashboard? If this is a Citrix XenApp/RDS server, do you only see some of the server's user sessions in the dashboard but not others?

    Could you take a look at uberAgent's log file, specifically the ReceiverStatistics message logged every five minutes. Are all events sent to Splunk (example in this KB article)?

  • 0
    Helge Klein

    Citrix AppCenter lists published applications, not RDS user sessions. That is the most likely explanation for you seeing a smaller number of "sessions" in uberAgent.

Please sign in to leave a comment.