Archive
Highlighted

Two saved searches throwing errors

New Member

When I attempt to run the searches "Cisco Firewall - Denies Over Last 24 Hours" or "Cisco Firewall - Accepts Over Last 24 Hours" I get the following error: ValueError: (22, 'Invalid argument') This page was linked to from https://splunk.ps.ak:8000:/en-US/APP/splunkforciscosecurity/rt_firewall

I tried running the saved searches by hand and they do work. I noticed that the saved searches for those reports differ from the others specified in savedsearches.conf in they are the only ones that have two "eventtypes" enumerated on the search line. Is this a bug in either the ciscofirewall or splunkforciscosecurity apps?

0 Karma
Highlighted

Re: Two saved searches throwing errors

Super Champion

ValueError is a python error type, which probably means that one of your search commands has an invalid parameter. But having not seen the search, that's just a guess. I don't think the eventtype thing should be an issue. (It's perfectly valid to say something like: "eventtype=A eventtype=B", if that's what you mean.)

0 Karma
Highlighted

Re: Two saved searches throwing errors

Splunk Employee
Splunk Employee

This is a bug (SOLN-1639) and it has been fixed in release 1.0.1 of Splunk_CiscoFirewalls.spl. Please download a new version of this add-on from Splunkbase.

-Dmitrii

0 Karma