I'm going crazy trying to troubleshoot this error with eventlog. I'm only using one mvfile replacement type and it is not working. The SA-Eventgen logs tell me this: time="2023-12-06T19:42:32Z" level=warning msg="No srcField provided for mvfile replacement: " In my $SPLUNK_HOME/etc/apps/<app>/default/eventgen.conf file, I have: ...
token.2.token = "(\$customer_name\$)"
token.2.replacementType = mvfile
token.2.replacement = $SPLUNK_HOME/etc/apps/eventgen_yogaStudio/samples/customer_info.txt:1
... My customer_info.txt:1 file contains: JoeSmith,43,Wisconsin,Pisces
JaneDoe,25,Kentucky,Gemini
... I'm getting JSON-formatted events but for customer_name, it's just blank: {
membership: gold
customer_name:
item: 30-day-pass
quantity: 4
ts: 1701892130
} I've tried the following sample file names: customer_info.txt customer_info.sample customer_info.csv Nothing seems to work. I'm going crazy!
... View more
