Alerts in Splunk Incidents

[vijreddy30]

Hi team 

Created the Customize field in Splunk Alert mechanism, but in the incident receiving the single record only , Multiple records are not fetching the incident, please find the below  

location=KC xxxxxxxx Corporate Center||comments=Look into VPR Quality Docs Notifications Outlook email for Actual errors||description=Login to VPR Server and Quality Docs Vault to troubleshoot issue;
$result._time$ $result.host$ $result.Message$ $result.source$ $result.log_level$ $result.error_message$

Please help me 

[tej57]

Hello @vijreddy30 ,

This may be possible because of following setting in the alert: Trigger

If this is set to Once, change it to "For each Result" and it should trigger alert for all the records.

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.