Mutilple alerts coming for each search results

[SG]

HI,

I have configured an alert to get the email when my query gives greater than 0 search results. I am able to see the alert but if search results are 3 I am getting 3 different emails as below.

In the above screenshot, we can see that all 3 different emails are triggered at the same time.  want all these results to be in one email alert. Can someone please help me with how can we get all the search results of a single alert?

Also in my alert trigger conditions, I have something like 

does that mean my Splunk alert expires after 24 hours? If it is so how can I change the settings to work the alert forever and if I need to stop the alert I will disable it.

Thanks in advance,

Swetha. G

[SG · Accepted solution]

I updated the Triggered value from "For each result" to once. Now I am getting all the search results in one alert email.

Thanks,

[ITWhisperer]

The 24 hours refers to how long the triggered alert stays in the list of triggered alerts (see under Activity/Triggered Alerts)

The other setting which you haven't shown is Trigger

How is yours set?