Anonymous_User Absent Member.
Absent Member.
132 views

Sentinel 7: Field name 'bgnt' is invalid.


- Click on "New Search" button
- Click on "Edit criteria" the pencil icon
- Click on "Action Time" on the left menu
- Click on "BeginTime" under Action Time on the left menu
- Click in the "Value" box under BeginTime field has:
- Select yesterdays date
- Click Ok
- Click Ok
- Click Search

This error is returned: "Invalid search filter: Cannot parse '(sev:[0 TO
5]) AND (bgnt:1396278066000)': Expression bgnt:1396278066000 in Lucene
query is invalid. Field name 'bgnt' is invalid. See Search tips for
information on constructing valid queries."
I have tried the same with a beginning date of two days ago and an
ending date of yesterday with the same results.

Sentinel Version: 7.1.1.2_1179

Any ideas?


--
dbenjamin
------------------------------------------------------------------------
dbenjamin's Profile: https://forums.netiq.com/member.php?userid=249
View this thread: https://forums.netiq.com/showthread.php?t=50414

0 Likes
1 Reply
Anonymous_User Absent Member.
Absent Member.

Re: Sentinel 7: Field name 'bgnt' is invalid.

That sounds particularly annoying and sounds like a bug. To help better
understand what may be causing this, here a few things to try or questions
to answer.

Have you tried using 'bgnt' on its own, such as 'bgnt:1396278066000' ?
Have you tried using just other fields to verify the error that "'bgnt' is
invalid'?
Have you been able to use the expression builder functionality with any
attribute (other than 'sev') and had it successfully find events or at
least parse the created expression?
Can you reproduce this on another system, perhaps just the appliance setup
to be a minimal installation for this test in a VM?

If it turns out to be a bug you can report it via a Service Request (SR)
or I can try to report it directly. Doing it via an SR means you get
notified of resolution, and can get builds from NetIQ/Novell engineering
when ready, and there are SLAs attached.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.