Splunk Search

How to diagnose a 400 Bad Request when running a search from C#?

RhinoTX
Explorer

I'm still stuck folks...

I have tried implementing 3 different methods of running a query from C# and none work, all get 400 Bad Request. I have correct address, port, and credentials. I cannot even /auth/login. It works from curl.exe, so I know I have access.

I need a way to diagnose WHY the request is bad. Where do I look on the server for USEFUL diagnostics / logs as to why the request is considered bad?

C# SDK is not an option. I need to eithe ruse WebClient or HttpWebRequest or hell even tried my own Socket version. ALL are returning 400 Bad Request.

Tags (3)
0 Karma
1 Solution

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

View solution in original post

0 Karma

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...