Using c# SavedSearchTemplateArgs hangs report when enumerating stream

New Member

The report below runs fine if the value for “Account Name” is hard coded like Account Name=a8hill. If I try to pass the $samaccountname$ parameter as in the code below, Splunk hangs on Line 263 in SearchResultsStreams.cs when enumerating the result. Please advise.

string query = "sourcetype=ADAuditLog:* Account_Name=$samaccountname$ earliest=-day | head 500";

SavedSearchDispatchArgs dispatch = new SavedSearchDispatchArgs(); (OR dispatch = null)

SavedSearchTemplateArgs template = new SavedSearchTemplateArgs();
Argument arg = new Argument("samaccountname", "a8hill");

await service.LogOnAsync(SplunkGlobal.Config.UserName, SplunkGlobal.Config.Password);

SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(searchName);

if (savedSearch != null)
Job job = await savedSearch.DispatchAsync(dispatch, template);

stream = await job.GetSearchResultsAsync();

foreach (SearchResult result in stream) //HANGS HERE WITH ERROR BELOW

Line 263 SearchResultsStreams.cs
Debug.Assert(reader.NodeType == XmlNodeType.EndElement && reader.Name == "results", "Expected: ");

Anthony Hill
ACT AD/Messaging Team

0 Karma

New Member

Stu, Anthony,
I think this is fixed in release 2.2.5 its availible on github.

0 Karma


I've got the same problem, but it seems to occur only when I run a search that returns no results.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!