All Apps and Add-ons
Highlighted

How to fix errors in Splunk_TA_ipfix/default/eventgen.conf

New Member

"splunk btool check --debug" command shows the following errors. We have splunk 6.21 and SplunkTAipfix 5.02. Any idea as what to do to fix this?

Checking: /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf, line 4: mode (value: sample)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf, line 6: sampletype (value: raw)
Did you mean 'spoolDir'?
Did you mean 'spoolFile'?
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf, line 8: bundlelines (value: true)
Did you mean 'breaker'?
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf, line 10: outputMode (value: splunkstream)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf, line 11: host (value: ns.acme)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/SplunkTAipfix/default/eventgen.conf, line 12: sourcetype (value: ipfix)
Did you mean 'spoolDir'?
Did you mean 'spoolFile'?

0 Karma
Highlighted

Re: How to fix errors in Splunk_TA_ipfix/default/eventgen.conf

Splunk Employee
Splunk Employee

If you need event generation, get the Eventgen from github and install it. If you don't, you can delete the conf file or add an eventgen.conf.spec.

View solution in original post

0 Karma