https://community.splunk.com/t5/Alerting/Throttle-alerts-based-on-field-value/m-p/172537#M2828 <P>Yes, change the <CODE>Alert mode</CODE> to <CODE>Once per result</CODE> which will enable a field called <CODE>Per result throttling fields</CODE> which is where you put <CODE>username</CODE>.</P> Thu, 13 Aug 2015 17:56:31 GMT woodcock 2015-08-13T17:56:31Z https://community.splunk.com/t5/Alerting/Throttle-alerts-based-on-field-value/m-p/172536#M2827 <P>Is it possible to throttle alerts by field value? </P> <P>For example: I want to alert when the value of field "action" is "delete" and throttle any subsequent results for 10 minutes unless the value of the field "username" changes.</P> Thu, 13 Aug 2015 02:08:44 GMT https://community.splunk.com/t5/Alerting/Throttle-alerts-based-on-field-value/m-p/172536#M2827 ckillg 2015-08-13T02:08:44Z https://community.splunk.com/t5/Alerting/Throttle-alerts-based-on-field-value/m-p/172537#M2828 <P>Yes, change the <CODE>Alert mode</CODE> to <CODE>Once per result</CODE> which will enable a field called <CODE>Per result throttling fields</CODE> which is where you put <CODE>username</CODE>.</P> Thu, 13 Aug 2015 17:56:31 GMT https://community.splunk.com/t5/Alerting/Throttle-alerts-based-on-field-value/m-p/172537#M2828 woodcock 2015-08-13T17:56:31Z