Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

rajakanapala — Mon, 15 Sep 2014 19:22:24 GMT

I am trying to run a search ( Macro) but I am not able to get past this error "The remote server returned an error: (400) Bad Request."

Here are my requirements -

1) Run this search ( most efficient way using C#.NET)
2) Get the output in XML
3) And then I would like to parse this XML and store the results in my local database

I am quite new to splunk, any help would be greatly appreciated

I am using C# and I also want to know if there is a better way of doing this

        // connection info
        var connectArgs = new ServiceArgs
        {
            Host = ConfigurationManager.AppSettings["SplunkHost"],
            Port = Convert.ToInt16(ConfigurationManager.AppSettings["Port"])
        };

        // Create new Service object
        Service service = new Service(connectArgs);

        // Use the Login method to connect
        service.Login(ConfigurationManager.AppSettings["Username"], ConfigurationManager.AppSettings["Password"]);        

        var mySearch = "`investigate(ipaddress,\"9/11/2014:10:40:0\",\"9/11/2014:10:45:0\",\"\")`";            

        var job = service.GetJobs().Create(mySearch);

        // Wait for the job to finish
        while (!job.IsDone)
        {
            Thread.Sleep(500);
        }

        // Create a UTF-8 encoding
        UTF8Encoding utf8 = new UTF8Encoding();

        // Display results
        var results = job.Results();
        String line = null;
        System.Console.WriteLine("Results from the search job as XML:\n");
        StreamReader sr = new StreamReader(results, utf8);
        while ((line = sr.ReadLine()) != null)
        {
            Response.Write(line);
        }

        sr.Close();

Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

rajakanapala — Mon, 15 Sep 2014 19:54:43 GMT

Update: - I have looked at the examples provided in the SDK but those are all console app related

Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

ma7859 — Tue, 08 Dec 2015 16:03:48 GMT

Even i am also facing the same issue. Any updates ?

Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

ma7859 — Tue, 08 Dec 2015 17:18:08 GMT

I got the solution.
We need to pass our splunk search starting with search .
Hope this helps someone.

topic Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#? in Splunk Search

Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

Re: Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?