https://community.splunk.com/t5/Splunk-Search/How-to-create-a-single-alert-for-multiple-error-codes/m-p/633947#M220176 <P>I can't recreate your issue.</P><P>Using this run anywhere example:</P><LI-CODE lang="markup">| makeresults count=100 | eval e = substr(tostring(random()), -1) | eval errors = case(e &lt;= 2, "Error1", e &lt;= 5, "Error2", e &lt;= 8, "Erro3" , 1=1, "Error4") | stats count by errors</LI-CODE><P>I set up an alert with a send email action and set the alert to be "For each result". I subsequently received four emails.</P><P>Make sure you're not throttling the alert, and make sure "For each result" is definitely set.</P><P>If you still have no luck then I suspect you could be hitting a bug? Can you share your Splunk version and a screenshot of the alert and I'll see if I can recreate it.</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 09 Mar 2023 21:14:21 GMT Tom_Lundie 2023-03-09T21:14:21Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-single-alert-for-multiple-error-codes/m-p/633881#M220155 <P>Following is my query:</P><P>index=backup | stats count by errors</P><P>I have thousands of error codes in logs and I need to trigger a unique alert for each error code. Is it possible to create a single alert? I have saved the above query with "for each result" option but still get only one trigger with all the error codes.&nbsp;</P> Thu, 09 Mar 2023 13:37:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-single-alert-for-multiple-error-codes/m-p/633881#M220155 shady6 2023-03-09T13:37:42Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-single-alert-for-multiple-error-codes/m-p/633947#M220176 <P>I can't recreate your issue.</P><P>Using this run anywhere example:</P><LI-CODE lang="markup">| makeresults count=100 | eval e = substr(tostring(random()), -1) | eval errors = case(e &lt;= 2, "Error1", e &lt;= 5, "Error2", e &lt;= 8, "Erro3" , 1=1, "Error4") | stats count by errors</LI-CODE><P>I set up an alert with a send email action and set the alert to be "For each result". I subsequently received four emails.</P><P>Make sure you're not throttling the alert, and make sure "For each result" is definitely set.</P><P>If you still have no luck then I suspect you could be hitting a bug? Can you share your Splunk version and a screenshot of the alert and I'll see if I can recreate it.</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 09 Mar 2023 21:14:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-single-alert-for-multiple-error-codes/m-p/633947#M220176 Tom_Lundie 2023-03-09T21:14:21Z