Hi All,
I am using the Splunk REST API to get the results in JSON from Splunk reports. I am able to get the results when the report name does not have any spaces in its name. However, when we have a space in the name, the REST API is unable to find the report and giving "unable to find saved search" error.
This is the endpoint I'm using:
curl -k -u userName:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="savedsearch "reportName"" -d output_mode=json
HI vamsy7, you'll have to uri encode the string, basically replacing the space and any other special characters with a encode symbol
There are many ways to do this, here's a good utility that does it : http://meyerweb.com/eric/tools/dencoder/
For instance, %20 is the encoded symbol for a whitespace character.
Please let me know if this answers your question!