Splunk Search

Why is .net SDK unable to run a blocking search?

vinaypradhan
Explorer

Hello all, if anybody had luck running a blocking search using the C# SDK, would appreciate your help.

I am trying to run a blocking search from a C# application. This is my code:

ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
var service = new Service(new Uri("mySplunkURL:8089"));
await service.LogOnAsync("username", "password");

SearchResultStream searchResultStream;
Job job;

job = await service.Jobs.CreateAsync(
"search index=_internal | head 10"
,new JobArgs() { ExecutionMode = ExecutionMode.Blocking });

At this point, I get an error that says
JobArgs does not contain a definition for 'ExecutionMode' 
I am following the documentation on the Splunk site, and doing exactly same 
https://dev.splunk.com/enterprise/docs/devtools/csharp/sdk-csharp/howdoicsharp2x/howtorunsearches

I don't know what am I missing here? Any help is greatly appreciated !! 

Vinay

Tags (2)
0 Karma
1 Solution

vinaypradhan
Explorer

hey yes, this is how I did it. 

SearchResultStream searchResultStream; 
 Job job;
  
 //create a job, setting the execution mode to "blocking"
 job = await service.Jobs.CreateAsync("yoursearchstring");
  
 // print search results
 IEnumerable<SearchResult> myresults;
 using (searchResultStream = await job.GetSearchResultsAsync())
 {
 myresults = searchResultStream.AsEnumerable<SearchResult>();
 foreach (SearchResult result in searchResultStream)
 {
 _time = Convert.ToDateTime(result.GetValue("_time"));
 UserName = result.GetValue("UserName");
 ComputerName = result.GetValue("ComputerName");
 }
 }

 

View solution in original post

0 Karma

ksorayya
New Member

Hey;

Did you figure out this issue?  I have the same problem.

 

0 Karma

vinaypradhan
Explorer

hey yes, this is how I did it. 

SearchResultStream searchResultStream; 
 Job job;
  
 //create a job, setting the execution mode to "blocking"
 job = await service.Jobs.CreateAsync("yoursearchstring");
  
 // print search results
 IEnumerable<SearchResult> myresults;
 using (searchResultStream = await job.GetSearchResultsAsync())
 {
 myresults = searchResultStream.AsEnumerable<SearchResult>();
 foreach (SearchResult result in searchResultStream)
 {
 _time = Convert.ToDateTime(result.GetValue("_time"));
 UserName = result.GetValue("UserName");
 ComputerName = result.GetValue("ComputerName");
 }
 }

 

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...