Splunk Search

searcing in splunk c# sdk 2.0 freezes

igala123123
New Member

using splunk 6.2 and c# sdk 2.0
first sdk 2.0 wasn't compiling,
there wasn't binaries bundled with it,
also the async api is very clumsy, needs also a sync api option too,

this is what i do:

    public static void Search()
    {
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3;
        ServicePointManager.ServerCertificateValidationCallback = (object s, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) => true;

        using (var service = new Service(Scheme.Https, "server-name", 8089, new Namespace(user: "nobody", app: "search")))
        {
            Run(service).Wait();
        }
    }


    static async Task Run(Service service)
    {
        try
        {
            var logon = service.LogOnAsync("Administrator", GetEncryptedString("AŦ9ɥʹѣզठ5Ŧܱठ"));
            logon.Wait();

            var search =  service.SearchOneShotAsync("search index=myIndex | where field2 == 61C27391748E8C8808AF75D852C4A9012E100722");
            search.Wait();
            SearchResultStream stream = search.Result;

            using (stream)
            {
                    foreach (SearchResult result in stream)
                    {
                    }
            }
        }
        catch (Exception e)
        {
        }
    }

when i call service.SearchOneShotAsync()
or service.Search() and try to get it's results
it freezes

tried sdk 1.0 ,
api seems more comfortable and was compiling,
but it's obsolete, as the rest paths doesn't exists in splunk 6.2 version

so i'm kind of stuck with it
index contains 200 entries so it shouldn't take too long

found some examples of the sdk here
searchcode.com/codesearch/view/90180186

what can i do to fix it?
thanks

0 Karma

igala123123
New Member

i think i found the problem/solution

on the service ctor , i removed the: new Namespace(user: "nobody", app: "search") arg

and
on this line:
var search = service.SearchOneShotAsync("search index=myIndex | where field2 == 61C27391748E8C8808AF75D852C4A9012E100722");

changed to
var search = service.SearchOneShotAsync("search index=myIndex | where field2 == \"61C27391748E8C8808AF75D852C4A9012E100722*\"*"); // escaping with \ "

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...