Splunk Search

Two saved searches throwing errors

mwtimken
New Member

When I attempt to run the searches "Cisco Firewall - Denies Over Last 24 Hours" or "Cisco Firewall - Accepts Over Last 24 Hours" I get the following error: ValueError: (22, 'Invalid argument') This page was linked to from https://splunk.ps.ak:8000:/en-US/APP/splunkforciscosecurity/rt_firewall

I tried running the saved searches by hand and they do work. I noticed that the saved searches for those reports differ from the others specified in savedsearches.conf in they are the only ones that have two "eventtypes" enumerated on the search line. Is this a bug in either the ciscofirewall or splunkforciscosecurity apps?

0 Karma

splunksolutions
Splunk Employee
Splunk Employee

This is a bug (SOLN-1639) and it has been fixed in release 1.0.1 of Splunk_CiscoFirewalls.spl. Please download a new version of this add-on from Splunkbase.

-Dmitrii

0 Karma

Lowell
Super Champion

ValueError is a python error type, which probably means that one of your search commands has an invalid parameter. But having not seen the search, that's just a guess. I don't think the eventtype thing should be an issue. (It's perfectly valid to say something like: "eventtype=A eventtype=B", if that's what you mean.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...

Join the Final Session of the Data Management & Federation Bootcamp Series

Over the past three sessions of the Data Management & Federation Bootcamp Series, we've explored how to build ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...