Splunk Search

Two saved searches throwing errors

mwtimken
New Member

When I attempt to run the searches "Cisco Firewall - Denies Over Last 24 Hours" or "Cisco Firewall - Accepts Over Last 24 Hours" I get the following error: ValueError: (22, 'Invalid argument') This page was linked to from https://splunk.ps.ak:8000:/en-US/APP/splunkforciscosecurity/rt_firewall

I tried running the saved searches by hand and they do work. I noticed that the saved searches for those reports differ from the others specified in savedsearches.conf in they are the only ones that have two "eventtypes" enumerated on the search line. Is this a bug in either the ciscofirewall or splunkforciscosecurity apps?

0 Karma

splunksolutions
Splunk Employee
Splunk Employee

This is a bug (SOLN-1639) and it has been fixed in release 1.0.1 of Splunk_CiscoFirewalls.spl. Please download a new version of this add-on from Splunkbase.

-Dmitrii

0 Karma

Lowell
Super Champion

ValueError is a python error type, which probably means that one of your search commands has an invalid parameter. But having not seen the search, that's just a guess. I don't think the eventtype thing should be an issue. (It's perfectly valid to say something like: "eventtype=A eventtype=B", if that's what you mean.)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...