Web Exception:
Server Reply: {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0}
Response: StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers:
{
Date: Mon, 02 May 2022 10:39:30 GMT
X-Content-Type-Options: nosniff
Vary: Authorization
Connection: close
X-Frame-Options: SAMEORIGIN
Server: Splunkd
Content-Type: application/json; charset=utf-8
Content-Length: 78
}
HResult: -2146233088
HttpEventCollectorEventInfo uses Thread.CurrentThread.CurrentCulture which makes it throw exception for DE, NL locales as they get confuse with (.) in timestamp .
There is suggestion to use static culture extension and change it to different locales(en-US) mainly to fix this issue.
https://community.splunk.com/t5/Getting-Data-In/Why-error-in-handling-indexed-fields-code-15-with-HEC-in-C/m-p/596508
But this does not help.
I siggest to make another constructor for HttpEventCollectorEventInfo setting it using given culture or just assume the culture should be en-us while setting timestamp.
Web Exception:
Server Reply: {"text":"Error in handling indexed fields","code":15,"invalid-event-number":0}
Response: StatusCode: 400, ReasonPhrase: 'Bad Request', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers:
{
Date: Mon, 02 May 2022 10:39:30 GMT
X-Content-Type-Options: nosniff
Vary: Authorization
Connection: close
X-Frame-Options: SAMEORIGIN
Server: Splunkd
Content-Type: application/json; charset=utf-8
Content-Length: 78
}
HResult: -2146233088
HttpEventCollectorEventInfo uses Thread.CurrentThread.CurrentCulture which makes it throw exception for DE, NL locales as they get confuse with (.) in timestamp .
There is suggestion to use static culture extension and change it to different locales(en-US) mainly to fix this issue.
https://community.splunk.com/t5/Getting-Data-In/Why-error-in-handling-indexed-fields-code-15-with-HEC-in-C/m-p/596508
But this does not help.
I siggest to make another constructor for HttpEventCollectorEventInfo setting it using given culture or just assume the culture should be en-us while setting timestamp.