2.2.8 SDK differences from 1.0 - field format

[rgonzale6]

We have a C# application, written many years ago, that uses SDK 1.0 to query Splunk and process the fields of interest in the results. Basically, it was done executing:

searchMgr = new SearchManager(_SplunkConnection);
searchJob = searchMgr.SyncSearch(searchQuery, dispatchParams)
rawResults = searchJob.GetResultsRaw(resultParams).ToString()

where the 'resultParams' specified a 'FieldList' of the specific result fields of interest. All the following code had to do was to loop through the XML representation of the individual field names and their corresponding results. I was hoping to find equivalent functionality in SDK 2.2.8, but the best I could find is: the following code executed after creating a 'Service' object and logging into Splunk:

SearchResultStream stream = await service.SearchOneShotAsync(searchQuery)
foreach (SearchResult anEvent in stream)
rawEventStr = anEvent.ToString()

This code will return the query results we are expecting, but in the format of a single very long string 'SearchResult(...)' where contents between the parentheses are basically of the form ': '. This string can be many hundreds of characters long with dozens of field names, most of which I don't care about. (Note that the old code only returned the fields I care about!)

I can probably write C# code that will parse this, but there has to be a better way to do it using SDK 2.2.8 functionality but after a lot of searching I can find nothing. Does anyone have a more elegant solution to this problem? Any help would be greatly appreciated.

[ewan000 · Accepted solution]

Hi,

You can access the fields with the GetValue(fieldname) method

        SearchResultStream stream = await service.SearchOneShotAsync("search index=main | head 10");

        foreach (SearchResult anEvent in stream)
        {
            foreach( var field in anEvent.FieldNames)
            {
                Console.WriteLine($"{field} = {anEvent.GetValue(field)}");
            }
        }

[rgonzale6]

Perfect! Many thanks!