All Apps and Add-ons

"No srcField provided for mvfile replacement" in eventgen logs

amorales_splunk
Splunk Employee
Splunk Employee

I'm going crazy trying to troubleshoot this error with eventlog. I'm only using one mvfile replacement type and it is not working. The SA-Eventgen logs tell me this:

 

 

 

time="2023-12-06T19:42:32Z" level=warning msg="No srcField provided for mvfile replacement: "

 

 

 

 

In my $SPLUNK_HOME/etc/apps/<app>/default/eventgen.conf file, I have:

 

 

 

...
token.2.token = "(\$customer_name\$)"
token.2.replacementType = mvfile
token.2.replacement = $SPLUNK_HOME/etc/apps/eventgen_yogaStudio/samples/customer_info.txt:1
...

 

 

 

 

My customer_info.txt:1 file contains:

 

 

 

JoeSmith,43,Wisconsin,Pisces
JaneDoe,25,Kentucky,Gemini
...

 

 

 

 

I'm getting JSON-formatted events but for customer_name, it's just blank:

 

 

 

{ 
   membership: gold
   customer_name:
   item: 30-day-pass
   quantity: 4
   ts: 1701892130
}

 

 

 

 

I've tried the following sample file names:

  • customer_info.txt
  • customer_info.sample
  • customer_info.csv

Nothing seems to work. I'm going crazy!

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...