I am trying to run a search ( Macro) but I am not able to get past this error "The remote server returned an error: (400) Bad Request."
Here are my requirements -
1) Run this search ( most efficient way using C#.NET)
2) Get the output in XML
3) And then I would like to parse this XML and store the results in my local database
I am quite new to splunk, any help would be greatly appreciated
I am using C# and I also want to know if there is a better way of doing this
// connection info
var connectArgs = new ServiceArgs
{
Host = ConfigurationManager.AppSettings["SplunkHost"],
Port = Convert.ToInt16(ConfigurationManager.AppSettings["Port"])
};
// Create new Service object
Service service = new Service(connectArgs);
// Use the Login method to connect
service.Login(ConfigurationManager.AppSettings["Username"], ConfigurationManager.AppSettings["Password"]);
var mySearch = "`investigate(ipaddress,\"9/11/2014:10:40:0\",\"9/11/2014:10:45:0\",\"\")`";
var job = service.GetJobs().Create(mySearch);
// Wait for the job to finish
while (!job.IsDone)
{
Thread.Sleep(500);
}
// Create a UTF-8 encoding
UTF8Encoding utf8 = new UTF8Encoding();
// Display results
var results = job.Results();
String line = null;
System.Console.WriteLine("Results from the search job as XML:\n");
StreamReader sr = new StreamReader(results, utf8);
while ((line = sr.ReadLine()) != null)
{
Response.Write(line);
}
sr.Close();
I got the solution.
We need to pass our splunk search starting with search .
Hope this helps someone.
Even i am also facing the same issue. Any updates ?
Update: - I have looked at the examples provided in the SDK but those are all console app related