Skip to content

error in handling indexed fields code 15 with HEC in C# #69

@jayaraut

Description

@jayaraut

Web Exception:
Server Reply: {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0}
Response: StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers:
{
Date: Mon, 02 May 2022 10:39:30 GMT
X-Content-Type-Options: nosniff
Vary: Authorization
Connection: close
X-Frame-Options: SAMEORIGIN
Server: Splunkd
Content-Type: application/json; charset=utf-8
Content-Length: 78
}
HResult: -2146233088

HttpEventCollectorEventInfo uses Thread.CurrentThread.CurrentCulture which makes it throw exception for DE, NL locales as they get confuse with (.) in timestamp .

There is suggestion to use static culture extension and change it to different locales(en-US) mainly to fix this issue.

https://community.splunk.com/t5/Getting-Data-In/Why-error-in-handling-indexed-fields-code-15-with-HEC-in-C/m-p/596508

But this does not help.

I siggest to make another constructor for HttpEventCollectorEventInfo setting it using given culture or just assume the culture should be en-us while setting timestamp.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions