Splunk Enterprise

Schema validation failed, unexpected property truncate while editing HEC

KnightRider
Engager

Hi Team,

Could you please throw some light here?

We are receiving the error "Schema validation failed, unexpected property truncate" while editing the HEC token for modifying the existing sourcetype to a new one.

Appreciate any help here. TIA

Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Ok. Please reach out Splunk Cloud Support there is nothing wrong in updating sourcetype.

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @KnightRider 

Did you see the splunkd log where HEC is deployed which will reveal more info?

0 Karma

KnightRider
Engager

@venkatasri I did go through the internal logs on HEC server, but didn't find any valuable information to proceed further troubleshooting. 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Try changing in inputs conf file and restart instance and observe splunkd logs for any errors.

0 Karma

KnightRider
Engager

HEC is on Splunk cloud and as you know, we dont have access to backend.

These hecs were created from backend initially, when we try to access it via UI for updating them, it just pops up with that error.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Ok. Please reach out Splunk Cloud Support there is nothing wrong in updating sourcetype.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...