https://community.splunk.com/t5/Splunk-Search/Throttling-parameters-in-realtime-search/m-p/32714#M178216 <P>Hello Everyone,<BR /> I have created alerts where i have to throttle according the fields.</P> <P>So my doubt is, whether i need to put the Renamed filed / the actual fields in throttling parameters</P> <P>e.g. index=main source=service | table host,service,Status| where Status="stopped"|RENAME host as "Server_Name"|RENAME service as "Service_Name"</P> <P>Throttling fields: host, service OR should be Server_Name, Service_Name<BR /> Alerts are per result basis. Please suggest on the scenario.</P> Mon, 28 Sep 2020 13:53:38 GMT linu1988 2020-09-28T13:53:38Z https://community.splunk.com/t5/Splunk-Search/Throttling-parameters-in-realtime-search/m-p/32714#M178216 <P>Hello Everyone,<BR /> I have created alerts where i have to throttle according the fields.</P> <P>So my doubt is, whether i need to put the Renamed filed / the actual fields in throttling parameters</P> <P>e.g. index=main source=service | table host,service,Status| where Status="stopped"|RENAME host as "Server_Name"|RENAME service as "Service_Name"</P> <P>Throttling fields: host, service OR should be Server_Name, Service_Name<BR /> Alerts are per result basis. Please suggest on the scenario.</P> Mon, 28 Sep 2020 13:53:38 GMT https://community.splunk.com/t5/Splunk-Search/Throttling-parameters-in-realtime-search/m-p/32714#M178216 linu1988 2020-09-28T13:53:38Z https://community.splunk.com/t5/Splunk-Search/Throttling-parameters-in-realtime-search/m-p/32715#M178217 <P>Hello,<BR /> I have figured it out by testing all the cases ,We always need to use the RENAMED field name for throttling, or it will not work</P> Fri, 21 Jun 2013 09:33:22 GMT https://community.splunk.com/t5/Splunk-Search/Throttling-parameters-in-realtime-search/m-p/32715#M178217 linu1988 2013-06-21T09:33:22Z