Exception: Read </results> where <result> or <response> was expected.

[YulerB]

Error raised by Splunk Client .net core version : Read </results> where <result> or <response> was expected.

When executing: using (SearchResultStream results = await client.ExportSearchResultsAsync(search, searchExportArgs))

[YulerB]

Just to add to this, I don't mind if you raise this error to say 0 results, as long as you set isfinal to true in the searchresults.

[YulerB]

I managed to get a trace:

Method: GET, RequestUri: 'https://splunk:7089/services/search/jobs/export?search=search index%3Dvast sourcetype%3Dvast%3A eventtype%3Dvast_detection_event earliest%3D1634870997 latest%3D1634871222 | sort 500000 %2B _indextime&f=HOST_ID&f=IP&f=PORT&f=PROTOCOL&f=TRACKING_METHOD&f=TYPE&f=severity&f=_indextime&f=_time&f=_cd&max_count=5000', Version: 1.1, Content: <null>, Headers: { Cookie: splunkd_7089=NDgRyfr4E7LciL7MTXmk0CTt7jkmp83QMMuzHVt_AqfvF004Ss2VjZmFmMY_cnu33RHj_jwomfeRuZruHTa5m_mtPJh8IqJopYiDvM9f^EzNeVdofdbkA9Mk79sSaN7MsdL User-Agent: splunk-sdk-csharp/2.2.8 } ``<?xml version='1.0' encoding='UTF-8'?>

HOST_ID IP PORT PROTOCOL TRACKING_METHOD TYPE severity _indextime _time _cd Your timerange was substituted based on your search string

Throws error: Readwhereor`` was expected.

Also the user agent is not what I expected, probably should have been something like: splunk-sdk-csharp-core/1.0.7

[YulerB]

Splunk Server Version: 8.2 Build: e053ef3c985f

[ncanumalla-splunk]

This SDK is deprecated and no longer under active development.