Exception returned from Splunk when running simple search query via the splunk java sdk

josephotoole — Mon, 28 Sep 2020 14:51:28 GMT

I am running one of the simple search examples provided in the splunk Java SDK distribution:

    public class Program {

public static void main(String[] args) {
    try {
        run(args);
    }
    catch (Exception e) {
        e.printStackTrace();
        System.exit(1);
    }
}

static void run(String[] args) throws IOException {
    Command command = Command.splunk("search");
    command.parse(args);

    if (command.args.length != 1)
        Command.error("Search expression required");
    String query = command.args[0];

    Service service = Service.connect(command.opts);

    // Check the syntax of the query.
    try {
        Args parseArgs = new Args("parse_only", true);
        service.parse(query, parseArgs);
    }
    catch (HttpException e) {
        String detail = e.getDetail();
        Command.error("query '%s' is invalid: %s", query, detail);
    }

    // This is the simplest form of searching splunk. Note that additional
    // arguments are allowed, but they are not shown in this example.
    InputStream stream = service.oneshotSearch(query);

    InputStreamReader reader = new InputStreamReader(stream, "UTF8");
    try {
        OutputStreamWriter writer = new OutputStreamWriter(System.out);
        try {
            int size = 1024;
            char[] buffer = new char[size];
            while (true) {
                int count = reader.read(buffer);
                if (count == -1) break;
                writer.write(buffer, 0, count);
            }

            writer.write("\n");
        }
        finally {
            writer.close();
        }
    }
    finally {
        reader.close();
    }
}

}

When running the example from the command line as follows:

java com.splunk.examples.search_simple.Program "search * |  head 10" --host=my_splunk_instance --port=80 --scheme=http

..I keep getting the following exception:

    [Fatal Error] :1:50: White spaces are required between publicId and systemId.

com.splunk.HttpException: HTTP 400
at com.splunk.HttpException.create(HttpException.java:59)
at com.splunk.HttpService.send(HttpService.java:355)
at com.splunk.Service.send(Service.java:1203)
at com.splunk.HttpService.post(HttpService.java:212)
at com.splunk.Service.oneshotSearch(Service.java:1094)
at com.splunk.Service.oneshotSearch(Service.java:1115)
at com.splunk.examples.search_simple.Program.run(Program.java:70)
at com.splunk.examples.search_simple.Program.main(Program.java:34)

It appears as if the server is expecting the request in XML or JSON format. Any help much appreciated

Thanks
Joe

Re: Exception returned from Splunk when running simple search query via the splunk java sdk

Damien_Dallimor — Fri, 27 Sep 2013 22:19:27 GMT

Your command looks wrong, try this , replace with your actual enviornment values :

java com.splunk.examples.search_simple.Program "search * |  head 10" --host=somehost --port=8089 --scheme=https --username=admin --password=somepass

topic Exception returned from Splunk when running simple search query via the splunk java sdk in Splunk Dev

Exception returned from Splunk when running simple search query via the splunk java sdk

Re: Exception returned from Splunk when running simple search query via the splunk java sdk