I have been using the Splunk API from within a Python script to retrieve information about saved searches using a call to the endpoint:
hxxps://<splunk_server>/-/-/saved/searches/<name_of_saved_search>?output_mode=json
The <name_of_saved_search> has been URL encoded to deal with some punctuation (including '/'), using the Python function:
name_of_searched_search = urllib.parse.quote(search_name, safe='')
It has been working so far, but recently I encountered an issue when the name of the saved search contains square brackets (e.g. "[123] My Search")
Even after URL encoding, Splunk's API just does not accept the API call at the endpoint:
hxxps://<splunk_server>/-/-/saved/searches/%5B123%5D%20My%20Search?output_mode=json
and returns a response with HTTP status code of 404 (Not Found).
I am not sure what else I should be doing to handle the square brackets in the name of the saved search to make the API call work.
