Splunk Dev

API call to retrieve information about a search when the search name contains brackets

CKM
New Member

I have been using the Splunk API from within a Python script to retrieve information about saved searches using a call to the endpoint:

 

hxxps://<splunk_server>/-/-/saved/searches/<name_of_saved_search>?output_mode=json

 

The <name_of_saved_search> has been URL encoded to deal with some punctuation (including '/'), using the Python function:

 

name_of_searched_search = urllib.parse.quote(search_name, safe='')

 

It has been working so far, but recently I encountered an issue when the name of the saved search contains square brackets (e.g. "[123] My Search")

Even after URL encoding, Splunk's API just does not accept the API call at the endpoint:

 

hxxps://<splunk_server>/-/-/saved/searches/%5B123%5D%20My%20Search?output_mode=json

 

and returns a response with HTTP status code of 404 (Not Found).

I am not sure what else I should be doing to handle the square brackets in the name of the saved search to make the API call work.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...