Inbuilt token in email alert is only sending first result, not all results from the column

New Member

Hello Splunkers,

I am trying to setup the alerts go to email and other integrations. When I use the inbuilt tokens like "$results.x$"- it gives only the first result from the search. How should I access other fields from the search results?

My search is something like this: index=* "xxxxxx" |.....|stats count by domain, name, ip

This search usually gives 3-4 unique columns like this-
| Domain | Name | IP |
| A | B | C |
| D | E | F |
| H | I | J |

Email alert should have all the results(columns) in it. Please help.

Thanks in advance.

0 Karma

New Member

Had the same problem but figured it out from looking at notable events, which behave the 'right' way.

At least in 7.2.x, you need to set

alert.digest_mode = 0

on the search in savedsearches.conf.
After that, using the $$ tokens in alerts will give you each of the events not just the first.

By default it's set to 1/true.

0 Karma


I think you are using Trigger= "once" option for your alert. In case you wish to send information for each row, you can change this option to "For each result".

With this option you will be able to get appropriate value for each token $result.$. However it will trigger as many mails as number of results.

0 Karma


@amalkapuram, $result.<fieldname>$ token is built to pull only the first row. You either need to have your query to filter to specific row you are interested in, or may be try transpose command to have results in single row (not sure if it is possible for three columns in your case).

Refer to Documentation:

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...