"splunk btool check --debug" command shows the following errors. We have splunk 6.21 and Splunk_TA_ipfix 5.02. Any idea as what to do to fix this?
Checking: /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 4: mode (value: sample)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 6: sampletype (value: raw)
Did you mean 'spoolDir'?
Did you mean 'spoolFile'?
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 8: bundlelines (value: true)
Did you mean 'breaker'?
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 10: outputMode (value: splunkstream)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 11: host (value: ns.acme)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 12: sourcetype (value: ipfix)
Did you mean 'spoolDir'?
Did you mean 'spoolFile'?
If you need event generation, get the Eventgen from github and install it. If you don't, you can delete the conf file or add an eventgen.conf.spec.
If you need event generation, get the Eventgen from github and install it. If you don't, you can delete the conf file or add an eventgen.conf.spec.