Splunk Search

How to diagnose a 400 Bad Request when running a search from C#?

RhinoTX
Explorer

I'm still stuck folks...

I have tried implementing 3 different methods of running a query from C# and none work, all get 400 Bad Request. I have correct address, port, and credentials. I cannot even /auth/login. It works from curl.exe, so I know I have access.

I need a way to diagnose WHY the request is bad. Where do I look on the server for USEFUL diagnostics / logs as to why the request is considered bad?

C# SDK is not an option. I need to eithe ruse WebClient or HttpWebRequest or hell even tried my own Socket version. ALL are returning 400 Bad Request.

Tags (3)
0 Karma
1 Solution

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

View solution in original post

0 Karma

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.