Hello Everyone, I’m running Cloud Custodian on Azure and using c7n-mailer with Azure Storage Queue (ASQ). I’m trying to forward notify events to Splunk HEC, but I’m consistently getting the following error from Splunk: Splunk POST returned non-20x response: 400 {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0} Curren*t mailer.yml* splunk_hec_url: https://splunkhec/services/collector/event splunk_hec_token: token splunk_hec_sourcetype: cloud_custodian queue_url: queue_url function_properties: servicePlan: name: c7n-plan storageAccount: name: c7nmaierstorage identity: type: SystemAssigned Policy Example policies: - name: find-unattached-pips resource: azure.publicip filters: - type: value key: properties.ipConfiguration value: null actions: - type: notify to: - splunkhec://index_name transport: type: asq queue: https://storageacc.queue.core.windows.net/c7n-mailer-queue Additional Context 1. This is Azure (not AWS). 2. A custom Python forwarder reading from the same Azure queue and posting to the same HEC token works without issues when sending a minimal JSON payload.