Splunk Search

How to diagnose a 400 Bad Request when running a search from C#?

RhinoTX
Explorer

I'm still stuck folks...

I have tried implementing 3 different methods of running a query from C# and none work, all get 400 Bad Request. I have correct address, port, and credentials. I cannot even /auth/login. It works from curl.exe, so I know I have access.

I need a way to diagnose WHY the request is bad. Where do I look on the server for USEFUL diagnostics / logs as to why the request is considered bad?

C# SDK is not an option. I need to eithe ruse WebClient or HttpWebRequest or hell even tried my own Socket version. ALL are returning 400 Bad Request.

Tags (3)
0 Karma
1 Solution

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

View solution in original post

0 Karma

RhinoTX
Explorer

I figured this out. The response was being swallowed by the exception being thrown. Once I started reading the response (in spite of the exception), I was able to see that there was a parse error on the input search string. The same input string s passed through CURL cmdline, but in that case the double-quotes are removed. The same double quotes were tripping up the parser.

This can be closed.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...