Getting Data In

Help deleting data input via REST API Please

sloaniebaloney
Engager

I am successfully utilizing the Splunk API through .Net and using GET, POST, and DELETE for many actions and all are working.

Working until I got to delete data inputs.

When I copy the exact url from a debugging session of my .Net code and paste it into cUrl, it works great. I am also url encoding the path.

My .Net code generates the following endpoint for deleting a data input via the rest API

https://localhost:8089/services/data/inputs/mon itor/c%3a%5cprogram+files%5cterso+solutions%5csplunk%5cindex_65b34d3a-463e-4950-8723-409193ee22d6%5cdi

The directory exists, however when this goes through .Net I get a 404.

When I take the text and pass it in through cUrl:

C:>curl -k -u admin:Password01 -X DELETE https://localhost:8089/services/data/inputs/mon itor/c%3a%5cprogram+files%5cterso+solutions%5csplunk%5cindex_65b34d3a-463e-4950-8723-409193ee22d6%5cdi

the data input deletes perfectly.

Does anyone have any suggestions?

Thanks.

0 Karma

ywu_splunk
Splunk Employee
Splunk Employee

This seems to be the same problem we encountered when developing Splunk C# SDK. It is due to URL munging inside .NET. To solve it, you may add genericUriParserOptions="DontUnescapePathDotsAndSlashes" to app.config, or use reflection to change .NET behavior.

Below is from code of Splunk C# SDK.

    /// <summary>
    /// Constructs a fully qualified URL for this service using a given
    /// path.
    /// </summary>
    /// <param name="path">The path.</param>
    /// <returns>The fully qualified URL.</returns>
    public Uri GetUrl(string path) 
    {
        // Taken from http://stackoverflow.com/questions/781205/getting-a-url-with-an-url-encoded-slash
        // WebRequest can munge an encoded URL, and we don't want it to. 
        // This technique forces WebRequest to leave the URL alone. There is
        // no simple mechanism to ask .Net to do this, once there is, this 
        // code can be changed. This code also may break in the future, as 
        // it reaches into the class's non-public fields and whacks them 
        // with a hammer. 
        //
        // An alternative is to use 
        // genericUriParserOptions="DontUnescapePathDotsAndSlashes"
        // in app.config. However, that is a global setting, which is owned
        // by the application using the Splunk SDK. There's no way to 
        // configure the setting just of the Splunk SDK assembly.
        Uri uri = new Uri(this.Prefix + path);
        string paq = uri.PathAndQuery; // need to access PathAndQuery
        FieldInfo flagsFieldInfo =
            typeof(Uri).GetField(
                "m_Flags", BindingFlags.Instance | BindingFlags.NonPublic);
        ulong flags = (ulong)flagsFieldInfo.GetValue(uri);
        // Flags.PathNotCanonical|Flags.QueryNotCanonical = 0x30
        flags &= ~((ulong)0x30);
        flagsFieldInfo.SetValue(uri, flags);
        return uri;
    }
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...