Create dynamic url for Splunk search

[man03359]

Hi Team,

Hope this finds all well.

I am trying to create a alert search query and need to create the splunk url as a dynamic value.

Here is my search query-

index=idx-cloud-azure "c899b9d3-bf20-4fd6-8b31-60aa05a14caa" metricName="CpuPercentage"
| eval CPU_Percent=round((average/maximum)*100,2)
| where CPU_Percent > 85
| stats earliest(_time) AS early_time latest(_time) AS late_time latest(CPU_Percent) AS CPU_Percent by amdl_ResourceName
| eval InstanceName="GSASMonitoring.High.CPU.Percentage"
| lookup Stores_IncidentAssignmentGroup_Reference InstanceName
| eval Minutes=(threshold/60)
| where Enabled=1
| eval short_description="GSAS App Service Plan High CPU",
       comments="GSAS Monitoring: High CPU Percentage ".CPU_Percent. " has been recorded"
       ```splunk url=""```
| eval key=InstanceName."-".amdl_ResourceName
| lookup Stores_SNOWIntegration_IncidentTracker _key as key OUTPUT _time as last_incident_time
| eval last_incident_time=coalesce(last_incident_time,0)
| where (late_time > last_incident_time + threshold)
| join type=left key 
    [| inputlookup Stores_OpenIncidents 
    | rex field=correlation_id "(?<key>(.*))(?=\_\w+\-?\w+\_?)"] 
| where ISNULL(dv_state)
| eval correlation_id=coalesce(correlation_id,key."_".late_time) 
| rename key as _key
| table short_description comments InstanceName category subcategory contact_type assignment_group impact urgency correlation_id account _key location

and here is the url of the entire search I am trying to convert into dynamic for line no 11-

https://tjxprod.splunkcloud.com/en-US/app/stores/search?dispatch.sample_ratio=1&display.page.search.mode=verbose&q=search%20index%3Didx-cloud-azure%20%22c899b9d3-bf20-4fd6-8b31-60aa05a14caa%22%20metricName%3D%22CpuPercentage%22%0A%7C%20eval%20CPU_Percent%3Dround((average%2Fmaximum)*100%2C2)%0A%7C%20where%20CPU_Percent%20%3E%2085%0A%7C%20stats%20earliest(_time)%20AS%20early_time%20latest(_time)%20AS%20late_time%20latest(CPU_Percent)%20AS%20CPU_Percent%20by%20amdl_ResourceName%0A%7C%20eval%20InstanceName%3D%22GSASMonitoring.High.CPU.Percentage%22%0A%7C%20lookup%20Stores_IncidentAssignmentGroup_Reference%20InstanceName%0A%7C%20eval%20Minutes%3D(threshold%2F60)%0A%7C%20where%20Enabled%3D1%0A%7C%20eval%20short_description%3D%22GSAS%20App%20Service%20Plan%20High%20CPU%22%2C%0A%20%20%20%20%20%20%20comments%3D%22GSAS%20Monitoring%3A%20High%20CPU%20Percentage%20%22.CPU_Percent.%20%22%20has%20been%20recorded%22%0A%7C%20eval%20key%3DInstanceName.%22-%22.amdl_ResourceName%0A%7C%20lookup%20Stores_SNOWIntegration_IncidentTracker%20_key%20as%20key%20OUTPUT%20_time%20as%20last_incident_time%0A%7C%20eval%20last_incident_time%3Dcoalesce(last_incident_time%2C0)%0A%7C%20where%20(late_time%20%3E%20last_incident_time%20%2B%20threshold)%0A%7C%20join%20type%3Dleft%20key%20%0A%20%20%20%20%5B%7C%20inputlookup%20Stores_OpenIncidents%20%0A%20%20%20%20%7C%20rex%20field%3Dcorrelation_id%20%22(%3F%3Ckey%3E(.*))(%3F%3D%5C_%5Cw%2B%5C-%3F%5Cw%2B%5C_%3F)%22%5D%20%0A%7C%20where%20ISNULL(dv_state)%0A%7C%20eval%20correlation_id%3Dcoalesce(correlation_id%2Ckey.%22_%22.late_time)%20%0A%7C%20rename%20key%20as%20_key%0A%7C%20table%20short_description%20comments%20InstanceName%20category%20subcategory%20contact_type%20assignment_group%20impact%20urgency%20correlation_id%20account%20_key%20location&earliest=-60m%40m&latest=now&display.page.search.tab=statistics&display.general.type=statistics&sid=1704721919.326369_52C57BD9-5296-4397-B370-BF36A375A0A5

[ITWhisperer]

It looks like you have a placeholder comment where you want to set a field called splunk url? Which parts of the url you listed are static and which parts are dynamic, and how do the dynamic parts relate to the fields you have present in your events at the point where the eval is done?