How to search for an alert via rest with a name that contains spaces?

[danielpops]

I have an alert named e.g. "My Alert". How do I search for it in Splunk using the REST API?

I can successfully search all alerts with:

| rest /services/alerts/fired_alerts/ 

But I cannot figure out how to search by name when the alert has spaces in it (all of our configured alerts have spaces, so I actually don't have one without spaces to test out separately). I've tried:

| rest /services/alerts/fired_alerts/My Alert/
| rest /services/alerts/fired_alerts/My%20Alert/

and neither works. They both fail with a "Failed to fetch REST endpoint" error message.

Any tips?

[MuS]

Hi danielpops,

Running on Splunk 6.4.0 this works for me:

| rest splunk_server=master /servicesNS/-/-/alerts/fired_alerts/My%20Test

the splunk_server is just added because this is my little DEV cluster environment running on my laptop. The result looks like this:

I'm using servicesNS/-/-/ instead of services because I want to get all alerts from all users in all apps. But

| rest splunk_server=master /services/alerts/fired_alerts/My%20Test

works as well and returns the same result for me.

Hope this helps ...

cheers, MuS

[frobinson_splun]

Hi @danielpops,
Have you tried an underscore character where the spaces occur?

Also, when you GET all fired alerts from the /alerts/fired_alerts endpoint, how does the name of your alert appear in the response? I'm not sure if you can use the same syntax to get the specific alert.

[danielpops]

Underscores doesn't seem to change the behavior. I still get

22 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/alerts/fired_alerts/My_Alert?count=0 from server=https://127.0.0.1:8089
The limit has been reached for log messages in info.csv. 40 messages have not been written to info.csv. Please refer to search.log for these messages or limits.conf to configure this limit.
[ip-xx-xx-xx-xx] Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/alerts/fired_alerts/My_Alert?count=0 from server=https://127.0.0.1:8089
[...]
0 events (3/21/16 12:00:00.000 AM to 4/20/16 8:09:27.000 PM)

I don't see my specific alerts in the GET all case, though I do see results on the alerts tab for that particular alert.

[frobinson_splun]

Thanks for the update. I am going to run this by some of my colleagues--it's possible you might need to contact Support to get more specific troubleshooting help. I'll report back shortly.

[frobinson_splun]

Hi again, @danielpops,
I've checked in with my colleagues. As @MuS mentions below, the correct way to indicate the space in an alert name is using %20, as in
| rest /services/alerts/fired_alerts/My%20Alert/

Given the error messages you are seeing, I'm not sure that they are related to using the endpoint. I would suggest that you contact Support to get more specific help:
http://www.splunk.com/en_us/about-us/contact.html#tabs/customer-support

or

http://www.splunk.com/en_us/support-and-services.html (See "Contact Support" at bottom of this page)