This functionality relies on the "The Splunk Event Generator" software available from https://github.com/splunk/eventgen.
Install the Eventgen app (https://splunkbase.splunk.com/app/1924/) on the indexer and perform the following:
Create directory `$SPLUNK_ROOT/etc/apps/TA-netflow/local/
if it doesn't exist
Copy eventgen.conf
from /default
to /local
folder and change the line:
disable = true
to
disable = false
Restart Splunk