The report below runs fine if the value for “Account Name” is hard coded like Account Name=a8hill. If I try to pass the $samaccountname$ parameter as in the code below, Splunk hangs on Line 263 in SearchResultsStreams.cs when enumerating the result. Please advise.
string query = "sourcetype=ADAuditLog:* Account_Name=$samaccountname$ earliest=-day | head 500";
SavedSearchDispatchArgs dispatch = new SavedSearchDispatchArgs(); (OR dispatch = null)
SavedSearchTemplateArgs template = new SavedSearchTemplateArgs();
Argument arg = new Argument("samaccountname", "a8hill");
template.Add(arg);
await service.LogOnAsync(SplunkGlobal.Config.UserName, SplunkGlobal.Config.Password);
SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync(searchName);
if (savedSearch != null)
{
Job job = await savedSearch.DispatchAsync(dispatch, template);
stream = await job.GetSearchResultsAsync();
foreach (SearchResult result in stream) //HANGS HERE WITH ERROR BELOW
{
Debug.WriteLine(result);
}
}
Line 263 SearchResultsStreams.cs
Debug.Assert(reader.NodeType == XmlNodeType.EndElement && reader.Name == "results", "Expected: ");
Anthony Hill
ACT AD/Messaging Team
