A wrong configuration script (configure.sh) in Splunk Add-on for NetFlow Ver 3.0.1.

[sunrise]

This post is not a question, but an enhancement request for Splunk Add-on for NetFlow Ver 3.0.1.
I installed Splunk Enterprise 6.2.5 and Splunk Add-on for NetFlow Ver 3.0.1 on a Linux server and configured it by "configure.sh" in this add-on.

Though I've done this almost default settings and transferred netflow packets to this UDP receiving port, I could not get any netflow packets in Splunk.

[huns0004]

I have also found this bug. Enter the days manually or change the script to do the null comparison first.

Disappointing that this has been out there for over a year and hasn't been fixed yet.

[thejohn]

the script has major errors which results in a broken flowfix.sh file.

[sunrise · Accepted solution]

In some tests, I got a solution to this issue.
I found that "configure.sh" may be wrong.

Original "configure.sh" in this App (Ver 3.0.1) includes following lines.
let keepDays=$keepDays-1
if [[ -z "$keepDays" ]]; then
keepDays="2"
fi

This causes wrong days to keep ascii flow logs in flowfix.sh which is executed by script stanza in inputs.conf.
find /opt/splunk625/etc/apps/Splunk_TA_flowfix/nfdump-ascii -type f -mtime +-1 -exec rm -f {} \;

So if you encounter this issue, you need to change flowfix.sh manually, or specify custom days during its configurations.