Splunk Search

Why is remote server returning error: (400) Bad Request trying to run a search macro using C#?

rajakanapala
New Member

I am trying to run a search ( Macro) but I am not able to get past this error "The remote server returned an error: (400) Bad Request."

Here are my requirements -

1) Run this search ( most efficient way using C#.NET)
2) Get the output in XML
3) And then I would like to parse this XML and store the results in my local database

I am quite new to splunk, any help would be greatly appreciated

I am using C# and I also want to know if there is a better way of doing this

        // connection info
        var connectArgs = new ServiceArgs
        {
            Host = ConfigurationManager.AppSettings["SplunkHost"],
            Port = Convert.ToInt16(ConfigurationManager.AppSettings["Port"])
        };

        // Create new Service object
        Service service = new Service(connectArgs);

        // Use the Login method to connect
        service.Login(ConfigurationManager.AppSettings["Username"], ConfigurationManager.AppSettings["Password"]);        

        var mySearch = "`investigate(ipaddress,\"9/11/2014:10:40:0\",\"9/11/2014:10:45:0\",\"\")`";            

        var job = service.GetJobs().Create(mySearch);

        // Wait for the job to finish
        while (!job.IsDone)
        {
            Thread.Sleep(500);
        }

        // Create a UTF-8 encoding
        UTF8Encoding utf8 = new UTF8Encoding();

        // Display results
        var results = job.Results();
        String line = null;
        System.Console.WriteLine("Results from the search job as XML:\n");
        StreamReader sr = new StreamReader(results, utf8);
        while ((line = sr.ReadLine()) != null)
        {
            Response.Write(line);
        }

        sr.Close();
Tags (4)
0 Karma

ma7859
Explorer

I got the solution.
We need to pass our splunk search starting with search .
Hope this helps someone.

0 Karma

ma7859
Explorer

Even i am also facing the same issue. Any updates ?

0 Karma

rajakanapala
New Member

Update: - I have looked at the examples provided in the SDK but those are all console app related

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...