Getting Data In

Bad request error from C# API

wdthem
Explorer

I am attempting to connect to our Splunk API instance via the C# API to do a search and I am receiving a 400 Bad Request error and I am not having much luck debugging it.

I am following the Search example in the C# demo solution from Splunk.

The code looks like this:

searchTerm = string.Format("--search=\"{0}\"", searchTerm);
var jobs = SplunkService.GetJobs();
var job = jobs.Create(searchTerm);

...and searchTerm equals:

index=prodabtest sourcetype=nlogab e=Development f=Sample v=SampleControl

I receive the Bad Request on the last line with it tries to create the job.

This appears to be the same thing the example solution is doing, so I am a bit at a loss.

Thanks!

-Will

Tags (2)
0 Karma
1 Solution

ywu_splunk
Splunk Employee
Splunk Employee

Code passes "--search=..." to API as search string. That is not correct. You would need to pass "searchTerm" directly to the API, for example, "search index=_internal * | head 100".

"--search=..." is used in the example as a command line argument marker. It is removed and the extracted search term is passed to API.

View solution in original post

ywu_splunk
Splunk Employee
Splunk Employee

Code passes "--search=..." to API as search string. That is not correct. You would need to pass "searchTerm" directly to the API, for example, "search index=_internal * | head 100".

"--search=..." is used in the example as a command line argument marker. It is removed and the extracted search term is passed to API.

wdthem
Explorer

Quick update: I am able to connect to the API instance via Curl, so I am pretty sure all is well with connection and authentication - just unsure of why the API code is throwing the error.

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...