Splunk Search

How to diagnose a 400 Bad Request when running a search from C#?

RhinoTX
Explorer

I'm still stuck folks...

I have tried implementing 3 different methods of running a query from C# and none work, all get 400 Bad Request. I have correct address, port, and credentials. I cannot even /auth/login. It works from curl.exe, so I know I have access.

I need a way to diagnose WHY the request is bad. Where do I look on the server for USEFUL diagnostics / logs as to why the request is considered bad?

C# SDK is not an option. I need to eithe ruse WebClient or HttpWebRequest or hell even tried my own Socket version. ALL are returning 400 Bad Request.

Tags (3)
0 Karma
1 Solution

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

View solution in original post

0 Karma

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...