topic Re: Why does this line from the C# SDK Example return error "System.IO.InvalidDataException: action.alert_manager.command"? in Splunk Dev

Why does this line from the C# SDK Example return error "System.IO.InvalidDataException: action.alert_manager.command"?

jaeshort — Thu, 06 Oct 2016 23:45:54 GMT

I copied the code from the C# SDK Example on http://dev.splunk.com/view/csharp-sdk-pcl/SP-CAAAEYZ

This following line always returns an error "System.IO.InvalidDataException: action.alert_manager.command"

SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync("example_search");

The "Report" or saved search does not exist.
So I tried with one with Owner=nobody and Sharing=Global and the App matches the app that I specified in the namespace of the service. Still no change in the error message.

Full Message:

"System.IO.InvalidDataException: action.alert_manager.command\r\n   at Splunk.Client.AtomEntry.d__32.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Splunk.Client.AtomEntry.d__34.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)\r\n   at Splunk.Client.AtomEntry.d__29.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForN
onSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)\r\n   at Splunk.Client.AtomFeed.d__40.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Splunk.Client.BaseEntity`1.<CreateAsync>d__18`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Splunk.Client.EntityCollection`2.d__13.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n

Re: Why does this line from the C# SDK Example return error "System.IO.InvalidDataException: action.alert_manager.command"?

jaeshort — Fri, 07 Oct 2016 00:24:27 GMT

It looks like I received an expected response when I look in Fiddler, but I don't know what I should be expecting. The following is the first part of the response. Too big to add it all in this comment.

<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
  <title>savedsearch</title>
  <id>https://ai-dev-log-01:8089/servicesNS/aisplunkapp/website_monitoring/saved/searches</id>
  <updated>2016-10-06T20:01:39-04:00</updated>
  <generator build="59c8927def0f" version="6.5.0"/>
  <author>
    <name>Splunk</name>
  </author>
  <link href="/servicesNS/aisplunkapp/website_monitoring/saved/searches/_new" rel="create"/>
  <link href="/servicesNS/aisplunkapp/website_monitoring/saved/searches/_reload" rel="_reload"/>
  <link href="/servicesNS/aisplunkapp/website_monitoring/saved/searches/_acl" rel="_acl"/>
  <opensearch:totalResults>1</opensearch:totalResults>
  <opensearch:itemsPerPage>30</opensearch:itemsPerPage>
  <opensearch:startIndex>0</opensearch:startIndex>
  <s:messages/>
  <entry>
    <title>website_performance_problems</title>
    <id>https://ai-dev-log-01:8089/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems</id>
    <updated>2016-10-06T20:01:39-04:00</updated>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems" rel="alternate"/>
    <author>
      <name>nobody</name>
    </author>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems" rel="list"/>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/_reload" rel="_reload"/>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems" rel="edit"/>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/disable" rel="disable"/>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/dispatch" rel="dispatch"/>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/embed" rel="embed"/>
    <link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/history" rel="history"/>
    <content type="text/xml">
      <s:dict>
        <s:key name="action.alert_manager">0</s:key>
        <s:key name="action.alert_manager.command">sendalert $action_name$ results_file="$results.file$" results_link="$results.url$"</s:key>
        <s:key name="action.alert_manager.description">Enable Incident tracking and management</s:key>
        <s:key name="action.alert_manager.disabled">0</s:key>
        <s:key name="action.alert_manager.hostname"></s:key>
        <s:key name="action.alert_manager.icon_path">alert_manager_icon.png</s:key>
        <s:key name="action.alert_manager.is_custom">1</s:key>
        <s:key name="action.alert_manager.label">Alert Manager</s:key>
        <s:key name="action.alert_manager.maxresults">10000</s:key>
        <s:key name="action.alert_manager.maxtime">5m</s:key>
        <s:key name="action.alert_manager.param.auto_assign_owner">unassigned</s:key>
        <s:key name="action.alert_manager.param.impact">low</s:key>
        <s:key name="action.alert_manager.param.urgency">low</s:key>
        <s:key name="action.alert_manager.payload_format">json</s:key>
        <s:key name="action.alert_manager.track_alert">0</s:key>
        <s:key name="action.alert_manager.ttl">10p</s:key>
        <s:key name="action.email">0</s:key>
        <s:key name="action.email.auth_password"></s:key>
        <s:key name="action.email.auth_username"></s:key>
        <s:key name="action.email.bcc"></s:key>
        <s:key name="action.email.cc"></s:key>
        <s:key name="action.email.cipherSuite">TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH</s:key>
        <s:key name="action.email.command"><![CDATA[$action.email.preprocess_results{default=""}$ | sendemail "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=10000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$"]]></s:key>
        <s:key name="action.email.content_type">html</s:key>
        <s:key name="action.email.description">Send an email notification to specified recipients</s:key>
        <s:key name="action.email.footer.text">If you believe you've received this email in error, please see your Splunk administrator.

Re: Why does this line from the C# SDK Example return error "System.IO.InvalidDataException: action.alert_manager.command"?

luclegault — Tue, 17 Oct 2017 18:30:30 GMT

I was getting the exact same error in c# SDK 2.x! This is what I did to fix it.

From the splunk-sdk-csharp-pcl-2.2.6 project edit the following class 1.src\Splunk.Client\Splunk\Client\AtomEntry.cs

Go to line 407 and look for the following code:

                for (int i = 0; i < names.Length - 1; i++)
                {
                    propertyName = NormalizePropertyName(names[i]);

                    if (dictionary.TryGetValue(propertyName, out propertyValue))
                    {
                        if (!(propertyValue is ExpandoObject))
                        {
                           throw new InvalidDataException(name); // TODO: Diagnostics : conversion error
                        }
                    }
                    else
                    {
                        propertyValue = new ExpandoObject();
                        dictionary.Add(propertyName, propertyValue);
                    }

                    dictionary = (IDictionary<string, object>)propertyValue;
                }

                propertyName = NormalizePropertyName(names[names.Length - 1]);
                propertyValue = await ParsePropertyValueAsync(reader, level + 1).ConfigureAwait(false);
                dictionary.Add(propertyName, propertyValue);

Replace the above code with this one:

                bool addDictionary = false;
                for (int i = 0; i < names.Length - 1; i++)
                {
                    addDictionary = true;
                    propertyName = NormalizePropertyName(names[i]);

                    if (dictionary.TryGetValue(propertyName, out propertyValue))
                    {
                        if (!(propertyValue is ExpandoObject))
                        {
                           // throw new InvalidDataException(name); // TODO: Diagnostics : conversion error
                           addDictionary = false;
                        }
                    }
                    else
                    {
                        propertyValue = new ExpandoObject();
                        dictionary.Add(propertyName, propertyValue);
                    }
                    if (addDictionary)
                    {
                        dictionary = (IDictionary<string, object>)propertyValue;
                    }

                }
                try
                {
                    propertyName = NormalizePropertyName(names[names.Length - 1]);
                    propertyValue = await ParsePropertyValueAsync(reader, level + 1).ConfigureAwait(false);
                    if (!dictionary.ContainsKey(propertyName))
                    {                            
                        dictionary.Add(propertyName, propertyValue);
                    }
                }
                catch (Exception er)
                { }

Recompile and then it will work!