---
title: Build the Splunk error-lookup URL
summary: Compose (or fall back to a default) Splunk deep-link URL for the current MessageID.
status: draft
owner: andmil
last_reviewed: 2026-09-15
library: SAIF.Web.API
reference_type: package
operation_id: OP-03
trigger: OP-01 (Post-process an API response), step 7.
---

# Build the Splunk error-lookup URL

`ApiResponseHandler.BuildMessageURL(IEnvironmentService)` composes a Splunk deep-link URL for the current `MessageID`, falling back to hard-coded defaults when configuration is unavailable.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-03 |
| **Trigger** | [Post-process an API response](op-01-post-process-an-api-response.md), step 7. |
| **Inputs** | `IEnvironmentService` (may be null) |
| **Outputs** | `string` URL |
| **Primary components** | `ApiResponseHandler.BuildMessageURL(IEnvironmentService)` |
| **Entry point** | `src/SAIF.Web.API/ApiResponseHandler.cs` |

## Steps

1. Initialize `resultUrl` and `splunkQuery` to `""`.
2. If `envService != null`, read `resultUrl = envService.GetConfigSetting("splunksearch")` and `splunkQuery = envService.GetConfigSetting("splunk.error.query")` ([BR-WEBAPI-006](../business-rules.md#br-webapi-006-splunk-lookup-url-always-produced)).
   - Skipped entirely when the service is unresolved.
   - `IEnvironmentService.GetConfigSetting` is implemented in `SAIF.Framework.Core`; its internal steps could not be embedded — the package is not indexed for this run.**
3. If `resultUrl` is null/empty, substitute the hard-coded defaults `https://splunk/en-US/app/search/search` and `search index=db_mssql sourcetype=Businessonline.error earliest=-1month` ([BR-WEBAPI-006](../business-rules.md#br-webapi-006-splunk-lookup-url-always-produced)).
   - Only `resultUrl` is tested; if `splunksearch` is configured but `splunk.error.query` is blank, the query portion stays empty.
4. Append `?q={Uri.EscapeDataString(splunkQuery + " " + MessageID)}` ([BR-WEBAPI-006](../business-rules.md#br-webapi-006-splunk-lookup-url-always-produced)).

Corroborated by the `BuildsResponseUrl` and `NullEnvironmentService` tests in `src/SAIF.Web.API.Tests/SAIF.Web.API.Tests/ApiResponseHandlerTests.cs`.

## Process flow

```mermaid
flowchart TD
	Start([Called from OP-01 step 7]) --> HasEnv{envService available?}
	HasEnv -->|Yes| Read["Read splunksearch /<br>splunk.error.query"]
	HasEnv -->|No| Default["Use hard-coded defaults"]
	Read --> Empty{resultUrl empty?}
	Empty -->|Yes| Default
	Empty -->|No| Append
	Default --> Append["Append ?q={query}<br>{MessageID}"]
	Append --> End([Return MessageIDUrl])
```

## Failure and edge-case behavior
- A configured `splunksearch` with a blank `splunk.error.query` yields a URL with an empty query fragment (no independent fallback for the query alone).

> **Note:** Statements marked with ** could not be confirmed; treat as unknown until verified.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.Web.API/ApiResponseHandler.cs`
- `src/SAIF.Web.API.Tests/SAIF.Web.API.Tests/ApiResponseHandlerTests.cs`