topic Re: Webhook from Splunk to Power Automate only sends one result - expecting multiple in Splunk Cloud Platform

Webhook from Splunk to Power Automate only sends one result - expecting multiple

tomapatan — Tue, 14 Oct 2025 12:44:55 GMT

Hello,

I’ve set up a scheduled alert in Splunk that sends results to a Power Automate webhook, which then parses the JSON and posts the data to a Microsoft Teams chat.
The issue I’m facing is that only one result is received, even though the search returns multiple events.

In Power Automate, the result field in the JSON payload is treated as an object, not an array.
As a workaround, I’ve configured Splunk to send one alert per result, but ideally I’d like to receive all results in a single webhook call and handle them as an array in Power Automate.
Has anyone encountered this before?
Any advice or examples would be greatly appreciated!

Thanks.

Re: Webhook from Splunk to Power Automate only sends one result - expecting multiple

livehybrid — Tue, 14 Oct 2025 14:55:40 GMT

Hi @tomapatan

In your alert, have you specified the Trigger frequency for"Once" or "For each result"? If you want it to trigger one webhook for each event then it should be "For each result"

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Webhook from Splunk to Power Automate only sends one result - expecting multiple

tomapatan — Tue, 14 Oct 2025 15:08:41 GMT

Hi @livehybrid

As a workaround, I’ve configured Splunk to send one alert per result, but ideally I’d like to receive all results in a single webhook call and handle them as an array in Power Automate.

Thanks,

Re: Webhook from Splunk to Power Automate only sends one result - expecting multiple

livehybrid — Tue, 14 Oct 2025 15:23:06 GMT

Hi @tomapatan

If you want to convert all your returned events into a single JSON object you can send you could try something like this:

| tojson | stats values(_raw) as _raw | eval _raw = "[".mvjoin(_raw,",")."]"

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Webhook from Splunk to Power Automate only sends one result - expecting multiple

tomapatan — Wed, 15 Oct 2025 09:37:51 GMT

This is expected behaviour, and the payload includes only the first result row from the triggering search results, according to the documentation.