Inbuilt token in email alert is only sending first result, not all results from the column

[amalkapuram]

Hello Splunkers,

I am trying to setup the alerts go to email and other integrations. When I use the inbuilt tokens like "$results.x$"- it gives only the first result from the search. How should I access other fields from the search results?

My search is something like this: index=* "xxxxxx" |.....|stats count by domain, name, ip

This search usually gives 3-4 unique columns like this-
| Domain | Name | IP |
| A | B | C |
| D | E | F |
| H | I | J |

Email alert should have all the results(columns) in it. Please help.

Thanks in advance.

[unstable23]

Had the same problem but figured it out from looking at notable events, which behave the 'right' way.

At least in 7.2.x, you need to set

alert.digest_mode = 0

on the search in savedsearches.conf.
After that, using the $result.foo$ tokens in alerts will give you each of the events not just the first.

By default it's set to 1/true.

[hardikJsheth]

I think you are using Trigger= "once" option for your alert. In case you wish to send information for each row, you can change this option to "For each result".

With this option you will be able to get appropriate value for each token $result.$. However it will trigger as many mails as number of results.

[niketn]

@amalkapuram, $result.<fieldname>$ token is built to pull only the first row. You either need to have your query to filter to specific row you are interested in, or may be try transpose command to have results in single row (not sure if it is possible for three columns in your case).

Refer to Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens#Result_tokens