Empty string value causing error - Read </value> where </text> was expected.

[sethisernhagen]

Version 2.2.2

I'm getting a InvalidDataException: Read </value> where <text> was expected. error when the returned data has a empty string value. Ex. Caption="".

I started receiving this error only after upgrading from version 2.1.2.

Stack Trace- [InvalidDataException: Read </value> where </text> was expected.] Splunk.Client.SearchResultStream.EnsureAwaiterSucceeded() +87 Splunk.Client.<GetEnumerator>d__11.MoveNext() +237..........

[David-Noble-at-work]

What version of Splunk are you running?

Sent from my iPhone

On Oct 12, 2015, at 10:20 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com> wrote:

Version 2.2.2

I'm getting a "InvalidDataException: Read where was expected." error when the returned data has a empty string value. Ex. Caption="".

I started receiving this error only after upgrading from version 2.1.2.

Stack Trace- [InvalidDataException: Read where was expected.] Splunk.Client.SearchResultStream.EnsureAwaiterSucceeded() +87 Splunk.Client.d__11.MoveNext() +237..........

— Reply to this email directly or view it on GitHubhttps://github.com/splunk/splunk-sdk-csharp-pcl/issues/44.

[sethisernhagen]

Splunk Enterprise version 6.1

[David-Noble-at-work]

Are you able to share some query results? If that’s possible, I’ve got a couple of curl commands I’d like you to run.

On Oct 12, 2015, at 10:35 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com> wrote:

Splunk Enterprise version 6.1

— Reply to this email directly or view it on GitHubhttps://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147470474.

[sethisernhagen]

Sure. I'd be happy to give it a go.

[David-Noble-at-work]

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0 curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

— Reply to this email directly or view it on GitHubhttps://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966.

[David-Noble-at-work]

I may have misspoke on max_count. Please set a specific value for it or no value at all.

On Oct 12, 2015, at 11:19 AM, David Noble dnoble@splunk.com<mailto:dnoble@splunk.com> wrote:

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0 curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

— Reply to this email directly or view it on GitHubhttps://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966.

[sethisernhagen]

Attached are the results of the two curl commands. Let me know if there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble notifications@github.com wrote:

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0 curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.com mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

— Reply to this email directly or view it on GitHub< https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

— Reply to this email directly or view it on GitHub https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147481168 .

[David-Noble-at-work]

Seth,

Thanks for running the commands, but I did not get the attachments. Would you mind resending?

Best, David Noble Developer Platform, Splunk Seattle

On Oct 12, 2015, at 11:52 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com> wrote:

Attached are the results of the two curl commands. Let me know if there if there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble notifications@github.com<mailto:notifications@github.com> wrote:

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0 curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

— Reply to this email directly or view it on GitHub< https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

— Reply to this email directly or view it on GitHub https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147481168 .

— Reply to this email directly or view it on GitHubhttps://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147490168.

[sethisernhagen]

Trying to attached again.

On Mon, Oct 12, 2015 at 11:58 AM David Noble notifications@github.com wrote:

Seth,

Thanks for running the commands, but I did not get the attachments. Would you mind resending?

Best, David Noble Developer Platform, Splunk Seattle

On Oct 12, 2015, at 11:52 AM, seth isernhagen <notifications@github.com mailto:notifications@github.com> wrote:

Attached are the results of the two curl commands. Let me know if there if there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble <notifications@github.com mailto:notifications@github.com> wrote:

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0 curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen <notifications@github.com mailto:notifications@github.com mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

— Reply to this email directly or view it on GitHub<

https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

— Reply to this email directly or view it on GitHub < https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147481168>

.

— Reply to this email directly or view it on GitHub< https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147490168>.

— Reply to this email directly or view it on GitHub https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147491384 .

[David-Noble-at-work]

Still no go. Would you sending the file directly to devinfo@splunk.commailto:devinfo@splunk.com.

On Oct 12, 2015, at 11:59 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com> wrote:

Trying to attached again.

On Mon, Oct 12, 2015 at 11:58 AM David Noble notifications@github.com<mailto:notifications@github.com> wrote:

Seth,

Thanks for running the commands, but I did not get the attachments. Would you mind resending?

Best, David Noble Developer Platform, Splunk Seattle

On Oct 12, 2015, at 11:52 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com mailto:notifications@github.com> wrote:

Attached are the results of the two curl commands. Let me know if there if there is anything else I can try to help troubleshoot this issue.

On Mon, Oct 12, 2015 at 11:19 AM David Noble notifications@github.com<mailto:notifications@github.com mailto:notifications@github.com> wrote:

Here are the commands that I’d like you too run. The first issues a search command with id=your_search. The second returns the results of the search command with id=your_search. Just substitute and—assuming you’re not using the default admin:changeme credentials—replace “admin:changeme” with your credentials.

curl -k -u admin:changeme https://localhost:8089/services/search/jobs --data-urlencode search="search " -d id=your_search -d count=0 -d max_count=0 curl -k -u admin:changeme https://localhost:8089/services/search/jobs/your_search > your_search_results.xml.

It’s the output from the second command—the contents of your_search_results.xml—that I’d like to see. Please attach that file to this e-mail.

The count=0 and max_count=0 options tell Splunk to return all results in a single xml document. You may need to execute the second command several times; until the search is done. You can always adjust the values of count (which controls the page size) and max_count (which controls the maximum number of results produced before Splunk finalizes the results; default: 50,000).

Thanks.

On Oct 12, 2015, at 10:45 AM, seth isernhagen notifications@github.com<mailto:notifications@github.com mailto:notifications@github.com mailto:notifications@github.com> wrote:

Sure. I'd be happy to give it a go.

— Reply to this email directly or view it on GitHub<

https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147472966>.

— Reply to this email directly or view it on GitHub < https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147481168>

.

— Reply to this email directly or view it on GitHub< https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147490168>.

— Reply to this email directly or view it on GitHub https://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147491384 .

— Reply to this email directly or view it on GitHubhttps://github.com/splunk/splunk-sdk-csharp-pcl/issues/44#issuecomment-147491631.

[sethisernhagen]

Oops

[David-Noble-at-work]

I resolved this issue with commit 6100d7f04ad8a94e25b75e9ae2ebb02de81be2d7 and added a test case for this condition. Seth verified the fix in his environment.