- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'm using splunk web to check some searches/alerts:
1. | rest /servicesNS/-/-/saved/searches/ splunk_server=local | table title <-- displays a list of saved searches
then I pick one from the list and launch:
2. rest /servicesNS/-/-/saved/searches/alert_without_white_spaces splunk_server=local. <-- and it works
But when querying for a differently named alert I get an error:
3. rest /servicesNS/-/-/saved/searches/alert with white spaces splunk_server=local. <-- does not work
- error message: Error in 'rest' command: Invalid argument: '-'
3a) rest /servicesNS/-/-/saved/searches/'alert with white spaces' splunk_server=local. <-- does not work
- error message: Error in 'rest' command: Invalid argument: '-'
3b) rest /servicesNS/-/-/saved/searches/"alert with white spaces" splunk_server=local. <-- does not work
- error message:
- Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/saved/searches/alert with white spaces?count=0 from server=https://127.0.0.1:8089 - Not Found
3d) rest /servicesNS/-/-/saved/searches/alert\ with\ white\ spaces splunk_server=local.
- error message: Error in 'rest' command: Invalid argument: '-\'
3e) | eval alert1="alert with white spaces"
| rest /servicesNS/-/-/saved/searches/alert1
- error message (splunk didn't use the variable value but the variable name)
- Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS/-/-/saved/searches/alert1?count=0 from server=https://127.0.0.1:8089 - Not Found
Is there a way to use variables or to query for a search name containing white spaces without getting an error ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Most probably, it needs to be urlencoded.
You can do it "by hand" or use https://splunkbase.splunk.com/app/4146
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Most probably, it needs to be urlencoded.
You can do it "by hand" or use https://splunkbase.splunk.com/app/4146
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)