https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698900#M16183 <P>I am using AWS SNS to send notifications, but I am not able to find a way to send all the results that triggered the query. I see $result._raw$ option but it does not contain any data in the notification.&nbsp;</P><P>Can anyone please help to confirm how to send all query results to SNS? Thanks in advance.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sudheerch_0-1726141994611.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32630i99673E8736EDED72/image-size/medium?v=v2&amp;px=400" role="button" title="sudheerch_0-1726141994611.png" alt="sudheerch_0-1726141994611.png" /></span></P><P>&nbsp;</P> Thu, 12 Sep 2024 11:56:23 GMT sudheerch 2024-09-12T11:56:23Z https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698900#M16183 <P>I am using AWS SNS to send notifications, but I am not able to find a way to send all the results that triggered the query. I see $result._raw$ option but it does not contain any data in the notification.&nbsp;</P><P>Can anyone please help to confirm how to send all query results to SNS? Thanks in advance.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sudheerch_0-1726141994611.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32630i99673E8736EDED72/image-size/medium?v=v2&amp;px=400" role="button" title="sudheerch_0-1726141994611.png" alt="sudheerch_0-1726141994611.png" /></span></P><P>&nbsp;</P> Thu, 12 Sep 2024 11:56:23 GMT https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698900#M16183 sudheerch 2024-09-12T11:56:23Z https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698901#M16184 <P>IIRC you only have access to the first row of the results so in order to send all the data you would have to contrive to have all the data in a single event.</P> Thu, 12 Sep 2024 12:00:52 GMT https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698901#M16184 ITWhisperer 2024-09-12T12:00:52Z https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698953#M16185 <P>Can you please help to share a documentation or some reference?</P> Fri, 13 Sep 2024 02:38:35 GMT https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698953#M16185 sudheerch 2024-09-13T02:38:35Z https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698963#M16186 <P><A href="https://docs.splunk.com/Documentation/Splunk/9.3.1/Alert/EmailNotificationTokens" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.3.1/Alert/EmailNotificationTokens</A></P><P>&nbsp;</P> Fri, 13 Sep 2024 07:26:06 GMT https://community.splunk.com/t5/Alerting/Send-all-results-using-SNS/m-p/698963#M16186 ITWhisperer 2024-09-13T07:26:06Z