NetFlow Analytics for Splunk: What does error "Server reported HTTP status=400 Unable to parse the search" mean?

[Nesrinepfe]

Hi,

What does this error message mean? Please someone help me! I'm blocked!

The error message is: Server reported HTTP status=400 Unable to parse the search: Comparator = has an invalid term on the left hand side.

Kind Regards

[Nesrinepfe · Accepted solution]

Hi,
I had a problem while I configured macros.conf .
Fortunately, I repeated all steps of the installation and Now it works well.

[dkeck]

Hi,

sounds similar to this:

https://answers.splunk.com/answers/26038/subsearch-does-not-work.html

are you using a sub search? please post your search string.

Kind Regards

[Nesrinepfe]

Hi,
Thank you very much for your response ^^ .
I'm using the App Netflow Logic.I have configured Netflow integrator to send netflow packets to Splunk. It works well.But When I open the App Netflow to visualize all results.I find this error message in every subsearch.Like i this photo.Please can you help me to repear it and find the solution.I didn't understand Why I have this message.What is the problem.Thanks in advance 🙂

[dkeck]

Hi,

I have no knowledge about this app, sry.

The Error sounds like there is something wrong with the search query of the dashboad panels.

Maybe just try to update or reupload the app you are using, to make sure nothing is missing.

Kind Regards

[Nesrinepfe]

Hi,
Thank very much Dkeck.No problem. I have reupload it.I will see about the update.
Thank you ^^
Best Regards