You can use fields from the first line of the results in the alert, e.g. $result.email$ assuming your search includes the email field. Then if you trigger the alert for each result (rather than just once), each result will execute the action with its corresponding row from the events. ... View more

@3666142  Can you please try this?   <dashboard> <label>Up_Down_single_View</label> <row> <panel> <single> <search> <query>index=index_name | rename msg.event.healthStatus as healthStatus | dedup healthStatus | table healthStatus | eval severity=if(healthStatus ="UP",1,4) | rangemap field=severity low=0-2 default=severe</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> </row> </dashboard>   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more