I copied the code from the C# SDK Example on http://dev.splunk.com/view/csharp-sdk-pcl/SP-CAAAEYZ
This following line always returns an error "System.IO.InvalidDataException: action.alert_manager.command"
SavedSearch savedSearch = await service.SavedSearches.GetOrNullAsync("example_search");
The "Report" or saved search does not exist.
So I tried with one with Owner=nobody and Sharing=Global and the App matches the app that I specified in the namespace of the service. Still no change in the error message.
Full Message:
"System.IO.InvalidDataException: action.alert_manager.command\r\n at Splunk.Client.AtomEntry.d__32.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Splunk.Client.AtomEntry.d__34.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)\r\n at Splunk.Client.AtomEntry.d__29.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForN
onSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)\r\n at Splunk.Client.AtomFeed.d__40.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Splunk.Client.BaseEntity`1.<CreateAsync>d__18`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Splunk.Client.EntityCollection`2.d__13.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n
I was getting the exact same error in c# SDK 2.x! This is what I did to fix it.
From the splunk-sdk-csharp-pcl-2.2.6 project edit the following class 1.src\Splunk.Client\Splunk\Client\AtomEntry.cs
Go to line 407 and look for the following code:
for (int i = 0; i < names.Length - 1; i++)
{
propertyName = NormalizePropertyName(names[i]);
if (dictionary.TryGetValue(propertyName, out propertyValue))
{
if (!(propertyValue is ExpandoObject))
{
throw new InvalidDataException(name); // TODO: Diagnostics : conversion error
}
}
else
{
propertyValue = new ExpandoObject();
dictionary.Add(propertyName, propertyValue);
}
dictionary = (IDictionary<string, object>)propertyValue;
}
propertyName = NormalizePropertyName(names[names.Length - 1]);
propertyValue = await ParsePropertyValueAsync(reader, level + 1).ConfigureAwait(false);
dictionary.Add(propertyName, propertyValue);
Replace the above code with this one:
bool addDictionary = false;
for (int i = 0; i < names.Length - 1; i++)
{
addDictionary = true;
propertyName = NormalizePropertyName(names[i]);
if (dictionary.TryGetValue(propertyName, out propertyValue))
{
if (!(propertyValue is ExpandoObject))
{
// throw new InvalidDataException(name); // TODO: Diagnostics : conversion error
addDictionary = false;
}
}
else
{
propertyValue = new ExpandoObject();
dictionary.Add(propertyName, propertyValue);
}
if (addDictionary)
{
dictionary = (IDictionary<string, object>)propertyValue;
}
}
try
{
propertyName = NormalizePropertyName(names[names.Length - 1]);
propertyValue = await ParsePropertyValueAsync(reader, level + 1).ConfigureAwait(false);
if (!dictionary.ContainsKey(propertyName))
{
dictionary.Add(propertyName, propertyValue);
}
}
catch (Exception er)
{ }
Recompile and then it will work!
It looks like I received an expected response when I look in Fiddler, but I don't know what I should be expecting. The following is the first part of the response. Too big to add it all in this comment.
<?xml version="1.0" encoding="UTF-8"?>
<!--This is to override browser formatting; see server.conf[httpServer] to disable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .-->
<?xml-stylesheet type="text/xml" href="/static/atom.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xmlns:s="http://dev.splunk.com/ns/rest" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
<title>savedsearch</title>
<id>https://ai-dev-log-01:8089/servicesNS/aisplunkapp/website_monitoring/saved/searches</id>
<updated>2016-10-06T20:01:39-04:00</updated>
<generator build="59c8927def0f" version="6.5.0"/>
<author>
<name>Splunk</name>
</author>
<link href="/servicesNS/aisplunkapp/website_monitoring/saved/searches/_new" rel="create"/>
<link href="/servicesNS/aisplunkapp/website_monitoring/saved/searches/_reload" rel="_reload"/>
<link href="/servicesNS/aisplunkapp/website_monitoring/saved/searches/_acl" rel="_acl"/>
<opensearch:totalResults>1</opensearch:totalResults>
<opensearch:itemsPerPage>30</opensearch:itemsPerPage>
<opensearch:startIndex>0</opensearch:startIndex>
<s:messages/>
<entry>
<title>website_performance_problems</title>
<id>https://ai-dev-log-01:8089/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems</id>
<updated>2016-10-06T20:01:39-04:00</updated>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems" rel="alternate"/>
<author>
<name>nobody</name>
</author>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems" rel="list"/>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/_reload" rel="_reload"/>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems" rel="edit"/>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/disable" rel="disable"/>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/dispatch" rel="dispatch"/>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/embed" rel="embed"/>
<link href="/servicesNS/nobody/website_monitoring/saved/searches/website_performance_problems/history" rel="history"/>
<content type="text/xml">
<s:dict>
<s:key name="action.alert_manager">0</s:key>
<s:key name="action.alert_manager.command">sendalert $action_name$ results_file="$results.file$" results_link="$results.url$"</s:key>
<s:key name="action.alert_manager.description">Enable Incident tracking and management</s:key>
<s:key name="action.alert_manager.disabled">0</s:key>
<s:key name="action.alert_manager.hostname"></s:key>
<s:key name="action.alert_manager.icon_path">alert_manager_icon.png</s:key>
<s:key name="action.alert_manager.is_custom">1</s:key>
<s:key name="action.alert_manager.label">Alert Manager</s:key>
<s:key name="action.alert_manager.maxresults">10000</s:key>
<s:key name="action.alert_manager.maxtime">5m</s:key>
<s:key name="action.alert_manager.param.auto_assign_owner">unassigned</s:key>
<s:key name="action.alert_manager.param.impact">low</s:key>
<s:key name="action.alert_manager.param.urgency">low</s:key>
<s:key name="action.alert_manager.payload_format">json</s:key>
<s:key name="action.alert_manager.track_alert">0</s:key>
<s:key name="action.alert_manager.ttl">10p</s:key>
<s:key name="action.email">0</s:key>
<s:key name="action.email.auth_password"></s:key>
<s:key name="action.email.auth_username"></s:key>
<s:key name="action.email.bcc"></s:key>
<s:key name="action.email.cc"></s:key>
<s:key name="action.email.cipherSuite">TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH</s:key>
<s:key name="action.email.command"><![CDATA[$action.email.preprocess_results{default=""}$ | sendemail "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=10000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$"]]></s:key>
<s:key name="action.email.content_type">html</s:key>
<s:key name="action.email.description">Send an email notification to specified recipients</s:key>
<s:key name="action.email.footer.text">If you believe you've received this email in error, please see your Splunk administrator.