"No srcField provided for mvfile replacement" in eventgen logs

[amorales_splunk]

I'm going crazy trying to troubleshoot this error with eventlog. I'm only using one mvfile replacement type and it is not working. The SA-Eventgen logs tell me this:

time="2023-12-06T19:42:32Z" level=warning msg="No srcField provided for mvfile replacement: "

In my $SPLUNK_HOME/etc/apps/<app>/default/eventgen.conf file, I have:

...
token.2.token = "(\$customer_name\$)"
token.2.replacementType = mvfile
token.2.replacement = $SPLUNK_HOME/etc/apps/eventgen_yogaStudio/samples/customer_info.txt:1
...

My customer_info.txt:1 file contains:

JoeSmith,43,Wisconsin,Pisces
JaneDoe,25,Kentucky,Gemini
...

I'm getting JSON-formatted events but for customer_name, it's just blank:

{ 
   membership: gold
   customer_name:
   item: 30-day-pass
   quantity: 4
   ts: 1701892130
}

I've tried the following sample file names:

• customer_info.txt
• customer_info.sample
• customer_info.csv

Nothing seems to work. I'm going crazy!

[scmgre]

I had this issue/error message but expanding $SPLUNK_HOME to the full path in eventgen.conf

token.2.replacement = /opt/splunk/etc/apps/SA-Eventgen/samples/partner.sample:1

and replacing all the windows carriage returns ^M with unix ones in my sample files and then restarting splunk fixed my issues.