How to log event to an index for Splunk alert with multiple results?

[spl_unker]

Hello Splunkers,

I would like to log event for Splunk alert  to an index . If Splunk alert returns only one result then there is no issue. But if there are multiple result it logs only one result randomly.

I have even chosen trigger alert for each result.

Any help on this would be great . TIA 

[spl_unker]

My alert action is to log an  event to an index for each result . But when there are multiple results for an alert ...it logs only one result to the index .  Attached screenshot of my alert 

[inventsekar]

just about this log event, you can see... "Trigger alert when"...

on that, "Number of results" is great than 0... change that zero to 1,... so that the trigger action will run only when you got one result. 

[spl_unker]

No , i guess my question is misunderstood.

If my alert throws 4 results .....i want all the 4 results to be logged into an index . Instead Splunk logs only one result into an index.

[gcusello]

Hi @spl_unker,

if you want to save results of an alert in a summary index you can configure a response action that makes this action.

I don't understand what you mean with "it logs only result randomly.".

You can have more results in one alert or have an alert for each results.

ciao.

Giuseppe