How can I produce a URL in an alert email that uses field values, either by in-line results or in the body of the email. When an alert is triggered an email is sent with field dashboard_url. For projects with no spaces in the name, the URL is clickable. If there is a space, the URL contains only up to the space and is broken.
| makeresults format=json data="[{\"project\":\"projectA - Team A\"},{\"project\":\"projectB\"}]"
| eval dashboard_url="https://internal.com:8000/en-US/app/search/dash?form.q_project=".project.""
Result: https://internal.com:8000/en-US/app/search/dash?form.q_project=projectA - Team A
I tried building the dashboard_url in the email body using results.project. The same condition occurs, projects with spaces get a broken link.
URLs with spaces in them must be encoded. Use the urlencode command available with the Webtools Add-on (https://splunkbase.splunk.com/app/4146).