This functionality relies on the "The Splunk Event Generator" software available from https://github.com/splunk/eventgen.
Install the Eventgen app (https://splunkbase.splunk.com/app/1924/) on the indexer and perform the following:
Create directory `
$SPLUNK_ROOT/etc/apps/TA-netflow/local/ if it doesn't exist
/local folder and change the line:
disable = true
disable = false