"log event alert action" only logs one event

[cam343]

Hello,
I'm trying to setup the "log event alert action" within Splunk 6.4.2. I have it working except when the search (alert) returns more than one search, only one event gets logged.

Eg. Search -1h for malware IP addresses through the proxy, I'd like to create a "log event" for each result.

How can I do this?

Thanks

[cam343 · Accepted solution]

I figured it out. I needed to change the alert mode to "once per result"