Hello,
I edited the c# splunk API search example and made it into the method below. It basically creates a connection then does a search and puts all the results into a list of csv. Which i use later.
the problem i am having is if the search takes a while to run, the connection gets closed so when i to too read each line from the stream i get an error saying "The request was aborted".
is there a way to set the timeout value?
or can i create the search, wait for it to finish, then re-connect to pull down the results.
public static List<string> SplunkSearch(string strQuery)
{
var cli = Command.Splunk("search");
cli.AddRule("search", typeof(string), "search string");
cli.Opts.Add("host", "host");
cli.Opts.Add("port", "8089");
cli.Opts.Add("scheme", "https");
cli.Opts.Add("username", "uname");
cli.Opts.Add("password", "pwd");
cli.Opts.Add("search",strQuery);
cli.Opts.Add("Timeout", "1000");
var service = Service.Connect(cli.Opts);
var jobs = service.GetJobs();
var job = jobs.Create((string)cli.Opts["search"]);
while (!job.IsDone)
{
Thread.Sleep(1000);
}
var outArgs = new Args
{
{ "output_mode", "csv" },
// Return all entries.
{ "count", "0" }
};
int intRun = 0;
string columnnames = "";
List<string> lstResults = new List<string>();
using (var stream = job.Results(outArgs))
{
using (StreamReader reader = new StreamReader(stream))
{
while (!reader.EndOfStream)
{
lstResults.Add(reader.ReadLine());
}
}
}
return lstResults;
}
