Empty string value causing error - Read </value> where </text> was expected.

[sethisernhagen]

Version 2.2.2

I'm getting a InvalidDataException: Read </value> where <text> was expected. error when the returned data has a empty string value. Ex. Caption="".

I started receiving this error only after upgrading from version 2.1.2.

Stack Trace-
[InvalidDataException: Read </value> where </text> was expected.] Splunk.Client.SearchResultStream.EnsureAwaiterSucceeded() +87 Splunk.Client.<GetEnumerator>d__11.MoveNext() +237..........

[David-Noble-at-work]

What version of Splunk are you running?

Sent from my iPhone

On Oct 12, 2015, at 10:20 AM, seth isernhagen <notifications@github.commailto:notifications@github.com> wrote:

Version 2.2.2

I'm getting a "InvalidDataException: Read where was expected." error when the returned data has a empty string value. Ex. Caption="".

I started receiving this error only after upgrading from version 2.1.2.

Stack Trace-
[InvalidDataException: Read where was expected.]
Splunk.Client.SearchResultStream.EnsureAwaiterSucceeded() +87
Splunk.Client.d__11.MoveNext() +237..........

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/44.

[sethisernhagen]

Splunk Enterprise version 6.1

[David-Noble-at-work]

Are you able to share some query results? If that’s possible, I’ve got a couple of curl commands I’d like you to run.

On Oct 12, 2015, at 10:35 AM, seth isernhagen <notifications@github.commailto:notifications@github.com> wrote:

Splunk Enterprise version 6.1

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/44#issuecomment-147470474.

[sethisernhagen]

Sure. I'd be happy to give it a go.

[David-Noble-at-work]

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.commailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/44#issuecomment-147472966.

[David-Noble-at-work]

I may have misspoke on max_count. Please set a specific value for it or no value at all.

On Oct 12, 2015, at 11:19 AM, David Noble <dnoble@splunk.commailto:dnoble@splunk.com> wrote:

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0
curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.commailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/44#issuecomment-147472966.

[sethisernhagen]

Attached are the results of the two curl commands. Let me know if there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble notifications@github.com
wrote:

Here are the commands that I’d like you too run. The first issues a search
command with id=your_search. The second returns the results of the search
command with id=your_search. Just substitute
and—assuming you’re not using the default admin:changeme
credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs
--data-urlencode search="search " -d id=your_search -d
count=0 -d max_count=0
curl -k -u admin:changeme
https://localhost:8089/services/search/jobs/your_search >
your_search_results.xml.

It’s the output from the second command—the contents of
your_search_results.xml—that I’d like to see. Please attach that file to
this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a
single xml document. You may need to execute the second command several
times; until the search is done. You can always adjust the values of count
(which controls the page size) and max_count (which controls the maximum
number of results produced before Splunk finalizes the results; default:
50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.com
mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

—
Reply to this email directly or view it on GitHub<
https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

—
Reply to this email directly or view it on GitHub
#44 (comment)
.

[David-Noble-at-work]

Seth,

Thanks for running the commands, but I did not get the attachments. Would you mind resending?

Best,
David Noble
Developer Platform, Splunk Seattle

On Oct 12, 2015, at 11:52 AM, seth isernhagen <notifications@github.commailto:notifications@github.com> wrote:

Attached are the results of the two curl commands. Let me know if there if
there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble <notifications@github.commailto:notifications@github.com>
wrote:

Here are the commands that I’d like you too run. The first issues a search
command with id=your_search. The second returns the results of the search
command with id=your_search. Just substitute
and—assuming you’re not using the default admin:changeme
credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs
--data-urlencode search="search " -d id=your_search -d
count=0 -d max_count=0
curl -k -u admin:changeme
https://localhost:8089/services/search/jobs/your_search >
your_search_results.xml.

It’s the output from the second command—the contents of
your_search_results.xml—that I’d like to see. Please attach that file to
this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a
single xml document. You may need to execute the second command several
times; until the search is done. You can always adjust the values of count
(which controls the page size) and max_count (which controls the maximum
number of results produced before Splunk finalizes the results; default:
50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.commailto:notifications@github.com
mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

—
Reply to this email directly or view it on GitHub<
https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

—
Reply to this email directly or view it on GitHub
#44 (comment)
.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/44#issuecomment-147490168.

[sethisernhagen]

Trying to attached again.

On Mon, Oct 12, 2015 at 11:58 AM David Noble notifications@github.com
wrote:

Seth,

Thanks for running the commands, but I did not get the attachments. Would
you mind resending?

Best,
David Noble
Developer Platform, Splunk Seattle

On Oct 12, 2015, at 11:52 AM, seth isernhagen <notifications@github.com
mailto:notifications@github.com> wrote:

Attached are the results of the two curl commands. Let me know if there if
there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble <notifications@github.com
mailto:notifications@github.com>
wrote:

Here are the commands that I’d like you too run. The first issues a
search
command with id=your_search. The second returns the results of the
search
command with id=your_search. Just substitute
and—assuming you’re not using the default admin:changeme
credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs
--data-urlencode search="search " -d id=your_search
-d
count=0 -d max_count=0
curl -k -u admin:changeme
https://localhost:8089/services/search/jobs/your_search >
your_search_results.xml.

It’s the output from the second command—the contents of
your_search_results.xml—that I’d like to see. Please attach that file to
this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in
a
single xml document. You may need to execute the second command several
times; until the search is done. You can always adjust the values of
count
(which controls the page size) and max_count (which controls the maximum
number of results produced before Splunk finalizes the results; default:
50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.com
mailto:notifications@github.com
mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

—
Reply to this email directly or view it on GitHub<

https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

—
Reply to this email directly or view it on GitHub
<
https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147481168>

.

—
Reply to this email directly or view it on GitHub<
https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147490168>.

—
Reply to this email directly or view it on GitHub
#44 (comment)
.

[David-Noble-at-work]

Still no go. Would you sending the file directly to devinfo@splunk.commailto:devinfo@splunk.com.

On Oct 12, 2015, at 11:59 AM, seth isernhagen <notifications@github.commailto:notifications@github.com> wrote:

Trying to attached again.

On Mon, Oct 12, 2015 at 11:58 AM David Noble <notifications@github.commailto:notifications@github.com>
wrote:

Seth,

Thanks for running the commands, but I did not get the attachments. Would
you mind resending?

Best,
David Noble
Developer Platform, Splunk Seattle

On Oct 12, 2015, at 11:52 AM, seth isernhagen <notifications@github.commailto:notifications@github.com
mailto:notifications@github.com> wrote:

Attached are the results of the two curl commands. Let me know if there if
there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble <notifications@github.commailto:notifications@github.com
mailto:notifications@github.com>
wrote:

Here are the commands that I’d like you too run. The first issues a
search
command with id=your_search. The second returns the results of the
search
command with id=your_search. Just substitute
and—assuming you’re not using the default admin:changeme
credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs
--data-urlencode search="search " -d id=your_search
-d
count=0 -d max_count=0
curl -k -u admin:changeme
https://localhost:8089/services/search/jobs/your_search >
your_search_results.xml.

It’s the output from the second command—the contents of
your_search_results.xml—that I’d like to see. Please attach that file to
this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in
a
single xml document. You may need to execute the second command several
times; until the search is done. You can always adjust the values of
count
(which controls the page size) and max_count (which controls the maximum
number of results produced before Splunk finalizes the results; default:
50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.commailto:notifications@github.com
mailto:notifications@github.com
mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

—
Reply to this email directly or view it on GitHub<

https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

—
Reply to this email directly or view it on GitHub
<
https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147481168>

.

—
Reply to this email directly or view it on GitHub<
https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147490168>.

—
Reply to this email directly or view it on GitHub
#44 (comment)
.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/44#issuecomment-147491631.

[sethisernhagen]

Oops

[David-Noble-at-work]

I resolved this issue with commit 6100d7f and added a test case for this condition. Seth verified the fix in his environment.