https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-a-custom-alert-on-the-basis-of-count-of-single/m-p/515586#M63124 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223580">@schiwark</a>,</P><P>did you tried something like this?</P><LI-CODE lang="markup">your_search earliest=-10m@m latest=now | stats values(fieldB) AS fieldB count BY fieldA | where count&gt;10</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sat, 22 Aug 2020 07:48:20 GMT gcusello 2020-08-22T07:48:20Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-a-custom-alert-on-the-basis-of-count-of-single/m-p/515578#M63123 <P>I want to configure an alert where alert should trigger if any unique value from field A is 5 or more than 5 in last 10 minutes.</P><P>I was able to configure the above part but along with the field A I also want the values of field B in an inline table of an alert which are associated with field A.</P><P>Can someone suggest me on this?</P> Sat, 22 Aug 2020 02:50:14 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-a-custom-alert-on-the-basis-of-count-of-single/m-p/515578#M63123 schiwark 2020-08-22T02:50:14Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-a-custom-alert-on-the-basis-of-count-of-single/m-p/515586#M63124 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223580">@schiwark</a>,</P><P>did you tried something like this?</P><LI-CODE lang="markup">your_search earliest=-10m@m latest=now | stats values(fieldB) AS fieldB count BY fieldA | where count&gt;10</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Sat, 22 Aug 2020 07:48:20 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-configure-a-custom-alert-on-the-basis-of-count-of-single/m-p/515586#M63124 gcusello 2020-08-22T07:48:20Z