It must be a bug in Splunk. This particular search head is running 6.5.0. I confirmed there is no validation expression shipped with App Exporter in my personal dev environment. The validation expression I found in the truncate(2) macro under the App Exporter context was identical to the validation expression used by SA-utils, although the eval was different.
... View more
Hi Martin, thanks for your response. I did verify this. SA-utils has a global truncate(2) macro. However, I disabled this macro for testing without success. Updating the validation expression for the truncate(2) macro in the app_exporter context is what fixed this error for me.
... View more
I just ran into this same problem with app exporter version 1.1. The truncate(2) macro that comes with the app exporter references the length variable as $n$, but uses the term length in the validation expression. Update the validation expression to read "isint(n) AND n>=0" and it should work.
... View more