We can disable the alert via command line with below command, but this doesnt work if the alert name has spaces in it.
curl -k -u admin https://<host>:<mgmt_port>/servicesNS/<user_context>/<app_context>/saved/searches/<search>/disable -X POST
I have a splunk alert Application Down Alert (Alert name has spaces in it)
How do i disable this alert via commandline.
Assuming you've already tried putting quotation marks around the URL, try urlencoding it by replacing the spaces with %20
View solution in original post
Thanks @richgalloway %20 worked fine for me.