Splunk Search

Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

rajakanapala
New Member

I am trying to run a search ( Macro) but I am not able to get past this error "The remote server returned an error: (400) Bad Request."

Here are my requirements -

1) Run this search ( most efficient way using C#.NET)
2) Get the output in XML
3) And then I would like to parse this XML and store the results in my local database

I am quite new to splunk, any help would be greatly appreciated

I am using C# and I also want to know if there is a better way of doing this

        // connection info
        var connectArgs = new ServiceArgs
        {
            Host = ConfigurationManager.AppSettings["SplunkHost"],
            Port = Convert.ToInt16(ConfigurationManager.AppSettings["Port"])
        };

        // Create new Service object
        Service service = new Service(connectArgs);

        // Use the Login method to connect
        service.Login(ConfigurationManager.AppSettings["Username"], ConfigurationManager.AppSettings["Password"]);        

        var mySearch = "`investigate(ipaddress,\"9/11/2014:10:40:0\",\"9/11/2014:10:45:0\",\"\")`";            

        var job = service.GetJobs().Create(mySearch);

        // Wait for the job to finish
        while (!job.IsDone)
        {
            Thread.Sleep(500);
        }

        // Create a UTF-8 encoding
        UTF8Encoding utf8 = new UTF8Encoding();

        // Display results
        var results = job.Results();
        String line = null;
        System.Console.WriteLine("Results from the search job as XML:\n");
        StreamReader sr = new StreamReader(results, utf8);
        while ((line = sr.ReadLine()) != null)
        {
            Response.Write(line);
        }

        sr.Close();
Tags (4)
0 Karma

ma7859
Explorer

I got the solution.
We need to pass our splunk search starting with search .
Hope this helps someone.

0 Karma

ma7859
Explorer

Even i am also facing the same issue. Any updates ?

0 Karma

rajakanapala
New Member

Update: - I have looked at the examples provided in the SDK but those are all console app related

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!