Splunk Dev

API call to retrieve information about a search when the search name contains brackets

CKM
New Member

I have been using the Splunk API from within a Python script to retrieve information about saved searches using a call to the endpoint:

 

hxxps://<splunk_server>/-/-/saved/searches/<name_of_saved_search>?output_mode=json

 

The <name_of_saved_search> has been URL encoded to deal with some punctuation (including '/'), using the Python function:

 

name_of_searched_search = urllib.parse.quote(search_name, safe='')

 

It has been working so far, but recently I encountered an issue when the name of the saved search contains square brackets (e.g. "[123] My Search")

Even after URL encoding, Splunk's API just does not accept the API call at the endpoint:

 

hxxps://<splunk_server>/-/-/saved/searches/%5B123%5D%20My%20Search?output_mode=json

 

and returns a response with HTTP status code of 404 (Not Found).

I am not sure what else I should be doing to handle the square brackets in the name of the saved search to make the API call work.

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...