https://community.splunk.com/t5/Splunk-Search/How-to-diagnose-a-400-Bad-Request-when-running-a-search-from-C/m-p/247200#M73742 <P>I'm still stuck folks...</P> <P>I have tried implementing 3 different methods of running a query from C# and none work, all get 400 Bad Request. I have correct address, port, and credentials. I cannot even /auth/login. It works from curl.exe, so I know I have access.</P> <P>I need a way to diagnose WHY the request is bad. Where do I look on the server for USEFUL diagnostics / logs as to why the request is considered bad?</P> <P>C# SDK is not an option. I need to eithe ruse WebClient or HttpWebRequest or hell even tried my own Socket version. ALL are returning 400 Bad Request.</P> Thu, 19 Jan 2017 20:05:54 GMT RhinoTX 2017-01-19T20:05:54Z https://community.splunk.com/t5/Splunk-Search/How-to-diagnose-a-400-Bad-Request-when-running-a-search-from-C/m-p/247200#M73742 <P>I'm still stuck folks...</P> <P>I have tried implementing 3 different methods of running a query from C# and none work, all get 400 Bad Request. I have correct address, port, and credentials. I cannot even /auth/login. It works from curl.exe, so I know I have access.</P> <P>I need a way to diagnose WHY the request is bad. Where do I look on the server for USEFUL diagnostics / logs as to why the request is considered bad?</P> <P>C# SDK is not an option. I need to eithe ruse WebClient or HttpWebRequest or hell even tried my own Socket version. ALL are returning 400 Bad Request.</P> Thu, 19 Jan 2017 20:05:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-diagnose-a-400-Bad-Request-when-running-a-search-from-C/m-p/247200#M73742 RhinoTX 2017-01-19T20:05:54Z https://community.splunk.com/t5/Splunk-Search/How-to-diagnose-a-400-Bad-Request-when-running-a-search-from-C/m-p/247201#M73743 <P>I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.</P> <P>This can be closed.</P> Fri, 20 Jan 2017 16:13:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-diagnose-a-400-Bad-Request-when-running-a-search-from-C/m-p/247201#M73743 RhinoTX 2017-01-20T16:13:09Z