https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205076#M3568 <P>Hi,</P> <P>I had the same problem, and in my case i just create a filed to mix the other to fields and use it to the throttiling setting.</P> <PRE><CODE>|eval throttling = field1.field2 </CODE></PRE> <P>Hope i help you</P> Thu, 14 Apr 2016 12:56:21 GMT jmallorquin 2016-04-14T12:56:21Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205075#M3567 <P>I have set up an alert that runs every 5 minutes to check for certain logs. I wanted to throttle the output based on 2 fields, so I enabled the throttle for 24 hrs and put the values in separated by a comma in the "Suppress results containing field value" field. </P> <P>However, it looks like my alert is not as accurate as it should be. The values in the "Suppress results containing field value", once separated by a comma, do they act as an AND condition or OR condition?</P> <P>So it's basically an alert set to run every 5 minutes throttled by 24 hrs based on 2 fields, which is not working as expected. </P> Thu, 14 Apr 2016 06:07:39 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205075#M3567 howwie 2016-04-14T06:07:39Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205076#M3568 <P>Hi,</P> <P>I had the same problem, and in my case i just create a filed to mix the other to fields and use it to the throttiling setting.</P> <PRE><CODE>|eval throttling = field1.field2 </CODE></PRE> <P>Hope i help you</P> Thu, 14 Apr 2016 12:56:21 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205076#M3568 jmallorquin 2016-04-14T12:56:21Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205077#M3569 <P>Great thanks, will give it a shot today. </P> Thu, 14 Apr 2016 16:17:09 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205077#M3569 howwie 2016-04-14T16:17:09Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205078#M3570 <P>I am having the same issue, and I do not quite understand what jmallorquin is suggesting. Does anyone else have the same issue or another solution?</P> Fri, 28 Oct 2016 17:15:58 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205078#M3570 devinmclean 2016-10-28T17:15:58Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205079#M3571 <P>The field names that you enter separated by a comma, act as an "AND" operation in accordance with the <A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts">Alerting Manual - Throttle Alert</A> reference. For example, if your Alert search query summarized alert signature hits per host like the following fields to a table:</P> <PRE><CODE>|table hostname, signature_id, signature_hit_time, signature_hit_count </CODE></PRE> <P>If you set the Alert trigger as <STRONG>Per-result</STRONG> (For each result), enabled <STRONG>Throttle</STRONG>, and in the <STRONG>Suppress results containing field value</STRONG> added <CODE>hostname, signature_id</CODE> then the "Per-result" alert for that combination of "hostname AND signature_id" would be suppressed via <STRONG>Suppress triggering for</STRONG> time value. (in Splunk 7.2)</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts">https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts</A></P> Sat, 06 Apr 2019 06:33:25 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205079#M3571 bwlm 2019-04-06T06:33:25Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205080#M3572 <P>It is <CODE>AND</CODE> logic.</P> Sun, 07 Apr 2019 15:03:36 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-run-every-5-minutes-with-an-alert/m-p/205080#M3572 woodcock 2019-04-07T15:03:36Z