Splunk Search

Splunk search REST API - Is there a way to search searches containing white space without error?

splunkmagu
Explorer

Hi,

I'm using splunk web to check some searches/alerts:

1. | rest /servicesNS/-/-/saved/searches/ splunk_server=local | table title <-- displays a list of saved searches

then I pick one from the list and launch:

2. rest /servicesNS/-/-/saved/searches/alert_without_white_spaces splunk_server=local. <-- and it works

But when querying for a differently named alert I get an error:

3. rest /servicesNS/-/-/saved/searches/alert with white spaces splunk_server=local. <-- does not work
- error message: Error in 'rest' command: Invalid argument: '-'

3a) rest /servicesNS/-/-/saved/searches/'alert with white spaces' splunk_server=local.   <-- does not work
- error message: Error in 'rest' command: Invalid argument: '-'

3b) rest /servicesNS/-/-/saved/searches/"alert with white spaces" splunk_server=local.   <-- does not work
- error message:

3d) rest /servicesNS/-/-/saved/searches/alert\ with\ white\ spaces splunk_server=local. 
- error message: Error in 'rest' command: Invalid argument: '-\'

3e) | eval alert1="alert with white spaces" 
        | rest /servicesNS/-/-/saved/searches/alert1
- error message (splunk didn't use the variable value but the variable name)


Is there a way to use variables or to query for a search name containing white spaces without getting an error ?

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Most probably, it needs to be urlencoded.

You can do it "by hand" or use https://splunkbase.splunk.com/app/4146

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Most probably, it needs to be urlencoded.

You can do it "by hand" or use https://splunkbase.splunk.com/app/4146

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...