Unable to Create or Edit an Ingest Ruleset: “Unable to load sourcetypes: bad character (49) in reply size”

Applicability

Description

When opening Settings > Ingest Actions > New Ruleset, or editing an existing ingest ruleset, the page may fail to load source types and display this error:

Unable to load sourcetypes: bad character (49) in reply size

The error may prevent the ruleset page from opening or cause it to return to the Ingest Actions page.

Investigation

1. Go to Settings > Ingest Actions and select New Ruleset, or try to edit an existing ruleset. Check whether the page displays the error shown above.
2. Check whether Settings > Source Types loads. Also check Data Inputs and note any unusual delays.
3. Run this search to check for related errors in the internal logs:

   index=_internal sourcetype=splunkd
   earliest=-15m latest=now
   (component=AdminManager OR component=HttpListener)
   ("bad character" OR "saved/sourcetypes")
   | sort 0 _time
   | table time component loglevel _raw

    

Resolution

Workarounds

1. Go to Settings > Source Types.
2. Clear Show Only popular source types.
3. Return to Settings > Ingest Actions and retry creating or editing the ruleset.