When I invoke the C# SDK example search() program to retrieve the same test data I submitted, I get some of my results printed to the command window, but then an exception is thrown:
Unhandled Exception: System.Net.WebException: The request was aborted: The connection was closed unexpectedly
I've learned the following about my error:
The spunk log file shows that the search job being run is completing successfully.
(1) is borne out by observing that the following code within Program.cs of search() completes successfully (commenting out the parts in Program.cs that follow where the data is actually accessed and written to the console):
while (!job.IsDone)
{
Thread.Sleep(1000);
}
// ...
The timeout error is occurring within the following block of code within Program.cs:
// ...
using (var stream = job.Results(outArgs)) {
using (var rr = new ResultsReaderXml(stream)) {
foreach (var @event in rr) {
System.Console.WriteLine("EVENT:");
foreach (string key in @event.Keys) {
System.Console.WriteLine(" " + key + " -> " + @event[key]);
}
}
}
}
The index being searched here has 43 events in it (all of which were put there via invocations of the submit() example program). The preceding loop is able to write about 26 of those entries to the screen before the "connection closed unexpectedly" exception is thrown. It would seem that the error has something to do with a timeout on the underlying stream supplied to the ResultsReaderXML. I've attempted to change a variety of timeout settings on that stream before passing it to the constructor, but there's no change in the behavior.
I'll just add that I've done nothing here beyond installing Splunk with all default configurations, downloading the C# SDK and building it, and then attempting to run the search() program. It's somewhat surprising that I'm encountering this error, as the index being searched is trivially small. Is the C# SDK still under development? Thanks.
-Andy
This is likely due to a problem with C# SDK and .NET. Thank you folks very much for investigating, reporting and detailed information. We will be working on a fix. In the meantime, you can apply the following work around.
Replace the following line in the search example included in the SDK:
using (var stream = job.Results(outArgs))
with two lines below:
var response = job.Service.Get(job.Path + "/results", outArgs);
using (var stream = response.Content)
More details of the bug:
The Job API is designed to return a .NET stream to applications to consume. The stream object is obtained through an HTTPWebResponse. After the stream object is returned, the HTTPWebResponse object is subject to garbage collection. If that happens before the stream is fully read by the application, the application will fail.
Again thank you very much and we apologize for this.
Just wanted to add that I'm running .NET version 3.5 per the SDK requirements:
http://dev.splunk.com/view/splunk-sdk-csharp/SP-CAAAEPK
“The Splunk SDK for C# supports development in Microsoft Visual Studio 2012. The minimum supported version of the .NET Framework is version 3.5.”