help with alert throttling needed

[damucka]

Hello,

I have the alert that produces the table as an output, let us say that it looks as follows:

SYSSID, HOST, EMAIL
BWP, h1, email_list_1
BWP, h1, email_list_2

Now, I would like that two separate alerts get triggered, one for the row1 and second for the row2, the idea is that they are then sent to separate email recipients.
Now, what I did what to use throttling per result with the following settings for "Suppress results containing field value
":
$result.SYSSID$, $result.HOST$, $result.EMAIL$

What I would expect from that is that I get two separate alerts triggered (per result) and they both get suspended for the given time (15 min). Unfortunately I am not able to get it working. What happens is that only the first row is "seen" when processing the alert and correspondingly I get only one alert triggered, which is wrong.

Could you please help?

Kind Regards,
Kamil

[493669 · Accepted solution]

Try entering direct fieldname in "Suppress results containing field value" box-

SYSSID,HOST,EMAIL

[damucka]

Thank you, it worked.

[493669]

I am converting my comment to an answer please accept and upvote if it helps. 🙂