Splunk_TA_nix startup typo Error

[hartfoml]

Anyone else get this typo error with the eventgen.conf

`Checking: $splunk/etc/apps/Splunk_TA_nix/default/eventgen.conf
        Possible typo in stanza [sample\.(openPortsEnhanced|passwd|service|update|selinuxChecker|sshdChecker|uptime|version|vsftpdChecker)\.(unix|linux|osx|solaris)] in $splunk/etc/apps/Splunk_TA_nix/default/eventgen.conf, line 185: randomizeEvents  =  true`

[araitz · Accepted solution]

Yes, this is a problem with the spec file that ships with the product for eventgen.conf ($SPLUNK_HOME/etc/system/README/eventgen.conf.spec). It isn't an updated version and doesn't understand the randomizeEvents parameter.

You can:

1) comment out all the randomizeEvents lines in eventgen.conf of the *nix TA (recommended)
2) update eventgen.conf.spec with the randomizeEvents specification (not recommended)

We will certainly try to fix this in a future version of the *nix TA.

[sowings]

I can verify that a stub .spec file can be created in an app-specific README directory to silence these warnings. Incidentally, they come from "btool check", and this is one way to validate that you've got the syntax of your homegrown .spec file correct.

Btool check is silent? The configs check out!

[araitz]

The spec files lives in README rather than default/local. I think (but am not sure) that you could create a Splunk_TA_nix/README/eventgen.conf.spec that would allow you to provide the missing parameters, but it seems like commenting out the settings themselves is easier.

[sloshburch]

Is it possible to edit a spec file that we keep in our system/local until this is resolved?

[araitz]

In general, it isn't recommended to edit files in the system directory. More specifically, the next time you upgrade Splunk, the change will be overwritten.

[hartfoml]

Can you comment on why I should not update the .spec file?

[hartfoml]

thanks for the help. this works

[sloshburch]

I also see this on 5.0.2. Was this a bug with 5.0.2?

[hartfoml]

I am on 4.3.1

[dbylertbg]

I am seeing this with Splunk 5.0.2 and Splunk_TA_nix 4.7.0.

[araitz]

What version of Splunk are you on? I haven't seen this on 5.0.x.