Alerting

Send all results using SNS

sudheerch
New Member

I am using AWS SNS to send notifications, but I am not able to find a way to send all the results that triggered the query. I see $result._raw$ option but it does not contain any data in the notification. 

Can anyone please help to confirm how to send all query results to SNS? Thanks in advance.

 

sudheerch_0-1726141994611.png

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

IIRC you only have access to the first row of the results so in order to send all the data you would have to contrive to have all the data in a single event.

0 Karma

sudheerch
New Member

Can you please help to share a documentation or some reference?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...