Webhook from Splunk to Power Automate only sends one result - expecting multiple

[tomapatan]

Hello,

I’ve set up a scheduled alert in Splunk that sends results to a Power Automate webhook, which then parses the JSON and posts the data to a Microsoft Teams chat.
The issue I’m facing is that only one result is received, even though the search returns multiple events.

In Power Automate, the result field in the JSON payload is treated as an object, not an array.
As a workaround, I’ve configured Splunk to send one alert per result, but ideally I’d like to receive all results in a single webhook call and handle them as an array in Power Automate.
Has anyone encountered this before? 
Any advice or examples would be greatly appreciated!

Thanks.

[tomapatan · Accepted solution]

This is expected behaviour, and the payload includes only the first result row from the triggering search results, according to the documentation.

[livehybrid]

Hi @tomapatan 

In your alert, have you specified the Trigger frequency for"Once" or "For each result"? If you want it to trigger one webhook for each event then it should be "For each result" 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[tomapatan]

Hi @livehybrid 

As a workaround, I’ve configured Splunk to send one alert per result, but ideally I’d like to receive all results in a single webhook call and handle them as an array in Power Automate.

Thanks,

[livehybrid]

Hi @tomapatan 

If you want to convert all your returned events into a single JSON object you can send you could try something like this:

| tojson
| stats values(_raw) as _raw
| eval _raw = "[".mvjoin(_raw,",")."]"

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing