Getting Data In

How to pass parameters that have spaces in the name to the Splunk REST API?

vamsy7
Engager

Hi All,

I am using the Splunk REST API to get the results in JSON from Splunk reports. I am able to get the results when the report name does not have any spaces in its name. However, when we have a space in the name, the REST API is unable to find the report and giving "unable to find saved search" error.

This is the endpoint I'm using:

curl -k -u userName:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="savedsearch "reportName"" -d output_mode=json

muebel
SplunkTrust
SplunkTrust

HI vamsy7, you'll have to uri encode the string, basically replacing the space and any other special characters with a encode symbol

There are many ways to do this, here's a good utility that does it : http://meyerweb.com/eric/tools/dencoder/

For instance, %20 is the encoded symbol for a whitespace character.

Please let me know if this answers your question!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...