uberAgent for Splunk is Here

You have been there: end-users are complaining and your boss demands an explanation why “Citrix is slow” - again. You, the XenApp/XenDesktop admin, desperately look at Task Manager and Perfmon, but you cannot find a thing. Your servers are humming along quite nicely, but still: applications are slow, the system feels sluggish and logons are taking forever. And then, all of a sudden, things are back to normal. What was going on? How do you prevent that from happening again?

One of the (many) great things about Splunk is that data, once indexed, is not being tampered with. Of course, you can choose for how long you want to retain your data, but Splunk won’t go and average multiple older events into one, because that would flatten peaks and remove potentially important detail.