Splunk Search

Two saved searches throwing errors

mwtimken
New Member

When I attempt to run the searches "Cisco Firewall - Denies Over Last 24 Hours" or "Cisco Firewall - Accepts Over Last 24 Hours" I get the following error: ValueError: (22, 'Invalid argument') This page was linked to from https://splunk.ps.ak:8000:/en-US/APP/splunkforciscosecurity/rt_firewall

I tried running the saved searches by hand and they do work. I noticed that the saved searches for those reports differ from the others specified in savedsearches.conf in they are the only ones that have two "eventtypes" enumerated on the search line. Is this a bug in either the ciscofirewall or splunkforciscosecurity apps?

0 Karma

splunksolutions
Splunk Employee
Splunk Employee

This is a bug (SOLN-1639) and it has been fixed in release 1.0.1 of Splunk_CiscoFirewalls.spl. Please download a new version of this add-on from Splunkbase.

-Dmitrii

0 Karma

Lowell
Super Champion

ValueError is a python error type, which probably means that one of your search commands has an invalid parameter. But having not seen the search, that's just a guess. I don't think the eventtype thing should be an issue. (It's perfectly valid to say something like: "eventtype=A eventtype=B", if that's what you mean.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mile High Learning with Splunk University, Denver, Colorado

If Denver is known for its mile-high elevation, Splunk University is about to raise the bar on technical ...

IT Service Intelligence 5.0 Series: Your Guide to the June Launch

We are excited to announce the June release of Splunk IT Service Intelligence (ITSI) 5.0. This update ...

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...