When I attempt to run the searches "Cisco Firewall - Denies Over Last 24 Hours" or "Cisco Firewall - Accepts Over Last 24 Hours" I get the following error: ValueError: (22, 'Invalid argument') This page was linked to from https://splunk.ps.ak:8000:/en-US/APP/splunkforciscosecurity/rt_firewall
I tried running the saved searches by hand and they do work. I noticed that the saved searches for those reports differ from the others specified in savedsearches.conf in they are the only ones that have two "eventtypes" enumerated on the search line. Is this a bug in either the ciscofirewall or splunkforciscosecurity apps?
This is a bug (SOLN-1639) and it has been fixed in release 1.0.1 of Splunk_CiscoFirewalls.spl. Please download a new version of this add-on from Splunkbase.
-Dmitrii
ValueError
is a python error type, which probably means that one of your search commands has an invalid parameter. But having not seen the search, that's just a guess. I don't think the eventtype thing should be an issue. (It's perfectly valid to say something like: "eventtype=A eventtype=B
", if that's what you mean.)