Hi All I have a requirement to trigger an alert email per Service in case of failures. I don't want to create separate alerts for each service. My search returns below results example - ServiceName Status Time EmailContact ABC failed 1/13/2017 8.50 am [email protected] ABC failed 1/13/2017 8.55 am [email protected] DEF failed 1/13/2017 9.00 am [email protected] How to get two emails from Splunk for ServiceName-ABC and ServiceName DEF? First email should sent to [email protected] with below 2 rows ServiceName Status Time EmailContact ABC failed 1/13/2017 8.50 am [email protected] ABC failed 1/13/2017 8.55 am [email protected] Second email should sent to [email protected] with below 1 rows ServiceName Status Time EmailContact DEF failed 1/13/2017 9.00 am [email protected] I have tried to use "map" command in the Custom trigger condition but it is not working. Please tell me the approach to accomplish this. Thanks !! Regards Selvaraj ... View more