How to get SCOM alerts and send single summary email of one's that have breached.

Question

Hi,
I'm trying to create a runbook which does as the title suggests, ie I want to get the 'Active' alerts from the console which have breached our SLA, which is No Critical or Warning alerts in resolution state of New for more than 24 hrs, and emails this list
to an internal Distribution List of all the potential service owners.  Its just intended as a daily email to poke the relevant people not to ignore the console alerts :-)
I'm able to Get Alerts OK, but from there I'm having diffs.  I have been given a powershell (as I'm no good at Powershell myself) which does the filtering to get the relevant breached alerts, but when I pass output to other activities and ultimately
to the create/send email, I end up only able to get multiple emails, one be alert which matches the filtering from powershell.  I have appended to a file to check that I can write the alert properties line by line, but for example if Ive 4 alerts then
I end up with 4 emails - I want one email with each alert detail (severity, Alert name, path,resolutionstate, Days/hrs in breach, Service Owner (custom Field 3) etc).  I have toyed with flattening the output with line breaks and/or commas at various points
along the activity chain to ftry force a single iteration of te send email but this just messes the format to the point of not being useful.
So was wondering if anyone could advise if this is possible, esp if able to do it using the standard activities  along with SCOM IP - I'm sure doing it all in powershell it a possible answer but I'm not proficient to do it - unless someone can provide
said script! :-)
Another possibility which has crossed my mind is to possible query the OpsMgr DB directly using the Alert ID from Get Alert but haven't tried tht yet.  I think I' stuggling to understand the basic of how the data is passed from activities esp using
the 'flatten outpout method..  My current runbook has the fllowing activities:
GetAlert -> Run .Net (powershell for filtering for breaced alerts) -> AppendFile (to Check the alert output) -> Create/Send Email(to send summary email).  What happens is if I have say 4 Breached emails in Console, when I run tester I
see GetAlert runs Once detail shows it has found 4 alerts), then each activity up the chain runs 4 times so that finally I end up with 4 emails.
If anyone has any suggestions it would be much appreciated - I can provide any more details/upload pic of current runbook if it helps...
Thanks...

Answer 1

Hi thanks for the suggestion.  I've tried playing around with the runbook using the Junction activity infront of the sendmail.  It doesnt appear to do anyting in itself (unless I'm not using it correctly).  The only way I can get the email
to only send once is if I flatten the output from the returned data behaviour - this works if I flatten at the Get Alert stage without the Junction activity or if I use the junction an flatten it then the email fires once.
However the problem with this is that each field for each alert is written vertically, so if I have 3 alerts returning 3 pieces of returned data I get:
<Alert1 datafield1>
<Alert2 datafield1>
<Alert3 datafield1>
<Alert1 datafield2>
<Alert2 datafield2>
<Alert3 datafield2>
<Alert1 datafield3>
<Alert2 datafield3>
<Alert3 datafield3>
wereas I wan the dat to appear in horizonally with each alert details on each row as like when written to a file, ie
<Alert1 datafield1> <Alert1 Datafield2> <Alert1 DataField3>
<Alert2 datafield1> <Alert2 Datafield2> <Alert2 DataField3>
<Alert3 datafield1> <Alert3 Datafield2> <Alert3 DataField3>
Without the use of flatten, the email which fires once for each alert has the data displayed correctly.  So essentially what I'm hoping to get is all returned alert details one per line/row in the body of the email...
If theres any easy way to do it withing the orchestrator activities would be great.  Otherwise it looks like I might have to try find a powershell or SQL script to pull back alert data.  Cheers...