Citrix ADM Service Add-on for Splunk enables you to convert to CIM (Common Information Model) compatible format the security events coming in from ADM Service splunk client. It offers a product agnostic event source for further consumption by your dashboards and analytics.
To download the add-on, go to Splunk base. Install the add-on on your Splunk Heavy Forwarder/Splunk Cloud Inputs Data Manager.
For more information regarding version support, system requirements, installation, configuration, troubleshooting and how to run the add-on, see Citrix Analytics Add-on for Splunk