Bad request error from C# API

[wdthem]

I am attempting to connect to our Splunk API instance via the C# API to do a search and I am receiving a 400 Bad Request error and I am not having much luck debugging it.

I am following the Search example in the C# demo solution from Splunk.

The code looks like this:

searchTerm = string.Format("--search=\"{0}\"", searchTerm);
var jobs = SplunkService.GetJobs();
var job = jobs.Create(searchTerm);

...and searchTerm equals:

index=prodabtest sourcetype=nlogab e=Development f=Sample v=SampleControl

I receive the Bad Request on the last line with it tries to create the job.

This appears to be the same thing the example solution is doing, so I am a bit at a loss.

Thanks!

-Will

[ywu_splunk · Accepted solution]

Code passes "--search=..." to API as search string. That is not correct. You would need to pass "searchTerm" directly to the API, for example, "search index=_internal * | head 100".

"--search=..." is used in the example as a command line argument marker. It is removed and the extracted search term is passed to API.

[wdthem]

Quick update: I am able to connect to the API instance via Curl, so I am pretty sure all is well with connection and authentication - just unsure of why the API code is throwing the error.