Run into this issue myself, by default the Pagerduty integration for Splunk deduplicates events on Search. In PagerDuty -: Services → Integrations → Integrations for Splunk → Edit integration Under 'deduplicate on' options list -: Search <- default option Component Host Source If open incident - attach results to it Don’t deduplicate If you select 'Don't deduplicate' you should find Pagerduty generate an incident for each event (if desired). ... View more