How to fix errors in Splunk_TA_ipfix/default/eventgen.conf

[qinli]

"splunk btool check --debug" command shows the following errors. We have splunk 6.21 and Splunk_TA_ipfix 5.02. Any idea as what to do to fix this?

Checking: /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 4: mode (value: sample)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 6: sampletype (value: raw)
Did you mean 'spoolDir'?
Did you mean 'spoolFile'?
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 8: bundlelines (value: true)
Did you mean 'breaker'?
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 10: outputMode (value: splunkstream)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 11: host (value: ns.acme)
Invalid key in stanza [appflow.raw] in /home/splunk/etc/apps/Splunk_TA_ipfix/default/eventgen.conf, line 12: sourcetype (value: ipfix)
Did you mean 'spoolDir'?
Did you mean 'spoolFile'?

[jcoates_splunk · Accepted solution]

If you need event generation, get the Eventgen from github and install it. If you don't, you can delete the conf file or add an eventgen.conf.spec.