Using c# SavedSearchTemplateArgs hangs report when enumerating stream

a8hill — Tue, 28 Jun 2016 16:27:53 GMT

The report below runs fine if the value for “Account Name” is hard coded like Account Name=a8hill. If I try to pass the $samaccountname$ parameter as in the code below, Splunk hangs on Line 263 in SearchResultsStreams.cs when enumerating the result. Please advise.

string query = "sourcetype=ADAuditLog:* Account_Name=$samaccountname$ earliest=-day | head 500";

SavedSearchDispatchArgs dispatch = new SavedSearchDispatchArgs(); (OR dispatch = null)

SavedSearchTemplateArgs template = new SavedSearchTemplateArgs();
Argument arg = new Argument("samaccountname", "a8hill");
template.Add(arg);

await service.LogOnAsync(SplunkGlobal.Config.UserName, SplunkGlobal.Config.Password);

SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(searchName);

if (savedSearch != null)
{
Job job = await savedSearch.DispatchAsync(dispatch, template);

stream = await job.GetSearchResultsAsync();

foreach (SearchResult result in stream) //HANGS HERE WITH ERROR BELOW
{
    Debug.WriteLine(result);
}
}

Line 263 SearchResultsStreams.cs
Debug.Assert(reader.NodeType == XmlNodeType.EndElement && reader.Name == "results", "Expected: ");

Anthony Hill
ACT AD/Messaging Team

Re: Using c# SavedSearchTemplateArgs hangs report when enumerating stream

Stuarth09 — Tue, 05 Jul 2016 15:36:29 GMT

I've got the same problem, but it seems to occur only when I run a search that returns no results.

Re: Using c# SavedSearchTemplateArgs hangs report when enumerating stream

tmackay2015 — Thu, 24 Nov 2016 00:37:00 GMT

Stu, Anthony,
I think this is fixed in release 2.2.5 its availible on github.
-Tom

topic Re: Using c# SavedSearchTemplateArgs hangs report when enumerating stream in Reporting

Using c# SavedSearchTemplateArgs hangs report when enumerating stream

Re: Using c# SavedSearchTemplateArgs hangs report when enumerating stream

Re: Using c# SavedSearchTemplateArgs hangs report when enumerating stream