Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

error in handling indexed fields code 15 with HEC in C# #69

Open
jayaraut opened this issue May 26, 2023 · 0 comments
Open

error in handling indexed fields code 15 with HEC in C# #69

jayaraut opened this issue May 26, 2023 · 0 comments

Comments

@jayaraut
Copy link

Web Exception:
Server Reply: {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0}
Response: StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers:
{
Date: Mon, 02 May 2022 10:39:30 GMT
X-Content-Type-Options: nosniff
Vary: Authorization
Connection: close
X-Frame-Options: SAMEORIGIN
Server: Splunkd
Content-Type: application/json; charset=utf-8
Content-Length: 78
}
HResult: -2146233088

HttpEventCollectorEventInfo uses Thread.CurrentThread.CurrentCulture which makes it throw exception for DE, NL locales as they get confuse with (.) in timestamp .

There is suggestion to use static culture extension and change it to different locales(en-US) mainly to fix this issue.

https://community.splunk.com/t5/Getting-Data-In/Why-error-in-handling-indexed-fields-code-15-with-HEC-in-C/m-p/596508

But this does not help.

I siggest to make another constructor for HttpEventCollectorEventInfo setting it using given culture or just assume the culture should be en-us while setting timestamp.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant