CrowdStrike Scheduled Search Technical Add-on encountered error

[CEWUD]

2025-09-10 03:36:13,986 ERROR pid=63604 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/ta_crowdstrike_falcon_event_streams/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/crowdstrike_event_streams.py", line 72, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/input_module_crowdstrike_event_streams.py", line 439, in collect_events crowdstrike_client() File "/opt/splunk/etc/apps/TA-crowdstrike-falcon-event-streams/bin/input_module_crowdstrike_event_streams.py", line 301, in crowdstrike_client num_feeds = len(response['resources']) TypeError: object of type 'NoneType' has no len()

[PickleRick]

If I wanted to be mean I'd write "oh, what a nice error you have there, thank you for sharing it with us".

You just copy-pasted a single error message. And what about it? Do you want help? If so you should have provided way more info about your configuration and circumstances of the error situation. Or maybe you wanted to brag about it - you finally managed to get that error after weeks of trying? In that case, great job!

But seriously - if you want us to help you, help us help you. It's one of the most frustrating things to get something like this on Answers - a single error line without any context.