https://community.splunk.com/t5/Alerting/alert/m-p/576989#M13288 <P>Hi</P><P>basically you should/could combine those event with bin or eventstats, based on your requirements (fixed or sliding span).&nbsp;</P><P>Here is one old answer for this&nbsp;<A href="https://community.splunk.com/t5/Alerting/how-to-generate-alert-based-on-the-count-of-unique-filed-value/m-p/329520" target="_blank">https://community.splunk.com/t5/Alerting/how-to-generate-alert-based-on-the-count-of-unique-filed-value/m-p/329520</A>&nbsp;and you could found more quite easily.</P><P>r. Ismo</P> Thu, 02 Dec 2021 08:02:29 GMT isoutamo 2021-12-02T08:02:29Z https://community.splunk.com/t5/Alerting/alert/m-p/576969#M13287 <P>Hi&nbsp;</P><P>Currently, My scheduled alert runs every five minutes but I need to get it triggered when the event count goes more than 2 in a minute. What is the best way to handle it?&nbsp;</P> Thu, 02 Dec 2021 02:13:23 GMT https://community.splunk.com/t5/Alerting/alert/m-p/576969#M13287 Param1987 2021-12-02T02:13:23Z https://community.splunk.com/t5/Alerting/alert/m-p/576989#M13288 <P>Hi</P><P>basically you should/could combine those event with bin or eventstats, based on your requirements (fixed or sliding span).&nbsp;</P><P>Here is one old answer for this&nbsp;<A href="https://community.splunk.com/t5/Alerting/how-to-generate-alert-based-on-the-count-of-unique-filed-value/m-p/329520" target="_blank">https://community.splunk.com/t5/Alerting/how-to-generate-alert-based-on-the-count-of-unique-filed-value/m-p/329520</A>&nbsp;and you could found more quite easily.</P><P>r. Ismo</P> Thu, 02 Dec 2021 08:02:29 GMT https://community.splunk.com/t5/Alerting/alert/m-p/576989#M13288 isoutamo 2021-12-02T08:02:29Z