Hi,
I've configured an Alert to be sent to Email and AWS SNS.
My query usually finds multiple results, when an alert gets sent to email, it's able to see all the results. However, when the alert is sent to AWS SNS, it only sees a single event (most likely the first one).
I've looked at https://docs.splunk.com/Documentation/AddOns/released/AWS/ModularAlert but can't see anything related to enabling sending of all events. Anyone have a clue?
The SNS alert looks like the following:
