Splunk Enterprise

Schema validation failed, unexpected property truncate while editing HEC

KnightRider
Engager

Hi Team,

Could you please throw some light here?

We are receiving the error "Schema validation failed, unexpected property truncate" while editing the HEC token for modifying the existing sourcetype to a new one.

Appreciate any help here. TIA

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Ok. Please reach out Splunk Cloud Support there is nothing wrong in updating sourcetype.

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @KnightRider 

Did you see the splunkd log where HEC is deployed which will reveal more info?

0 Karma

KnightRider
Engager

@venkatasri I did go through the internal logs on HEC server, but didn't find any valuable information to proceed further troubleshooting. 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Try changing in inputs conf file and restart instance and observe splunkd logs for any errors.

0 Karma

KnightRider
Engager

HEC is on Splunk cloud and as you know, we dont have access to backend.

These hecs were created from backend initially, when we try to access it via UI for updating them, it just pops up with that error.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Ok. Please reach out Splunk Cloud Support there is nothing wrong in updating sourcetype.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...