diff --git a/keep/api/routes/workflows.py b/keep/api/routes/workflows.py
index ee5e5014f..e4da0938a 100644
--- a/keep/api/routes/workflows.py
+++ b/keep/api/routes/workflows.py
@@ -337,7 +337,7 @@ async def create_workflow(
 ) -> WorkflowCreateOrUpdateDTO:
     tenant_id = authenticated_entity.tenant_id
     created_by = authenticated_entity.email
-    workflow = __get_workflow_raw_data(request=None, file=file)
+    workflow = await __get_workflow_raw_data(request=None, file=file)
     workflowstore = WorkflowStore()
     # Create the workflow
     try:
diff --git a/keep/providers/splunk_provider/splunk_provider.py b/keep/providers/splunk_provider/splunk_provider.py
index d0b6c6db0..ef56f54ef 100644
--- a/keep/providers/splunk_provider/splunk_provider.py
+++ b/keep/providers/splunk_provider/splunk_provider.py
@@ -154,7 +154,7 @@ def _format_alert(
         result: dict = event.get("result", event.get("_result", {}))
 
         try:
-            raw: str = event.get("_raw", "{}")
+            raw: str = result.get("_raw", "{}")
             raw_dict: dict = json.loads(raw)
         except Exception as e:
             logger = logging.getLogger(__name__)
@@ -178,9 +178,9 @@ def _format_alert(
             "exception",
             result.get(
                 "exception",
-                result.get("exception_class", raw_dict.get("exception_class")),
+                result.get("exception_class"),
             ),
-        )
+        ) or raw_dict.get("exception_class", "")
 
         # override stacktrace with _raw stacktrace if it doesnt exist in result
         stacktrace = result.get("stacktrace", raw_dict.get("stacktrace", ""))