Send all results using SNS

[sudheerch]

I am using AWS SNS to send notifications, but I am not able to find a way to send all the results that triggered the query. I see $result._raw$ option but it does not contain any data in the notification. 

Can anyone please help to confirm how to send all query results to SNS? Thanks in advance.

sudheerch_0-1726141994611.png

[ITWhisperer]

IIRC you only have access to the first row of the results so in order to send all the data you would have to contrive to have all the data in a single event.

[sudheerch]

Can you please help to share a documentation or some reference?

[ITWhisperer]

https://docs.splunk.com/Documentation/Splunk/9.3.1/Alert/EmailNotificationTokens