The basic email alert takes only a statics email list. For custom alerting, create your own alerting script. Then you will be able to preprocess anything you need, and create custom emails to custom destinations. The script will be passed the path to the results in a csv format. http://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts And If you want each result to have it's own destination, you could add a layer to your search to append the email destination to the events (with a lookup or some eval logic). Then have your script to iterate per line of result. Remark : I do not recommend to use too many realtime alerts, keep them for really urgent alerts. For anything else, use scheduled alerts (with a delay for accounting on the indexing latency). ... View more