I have added throttling to alert i.e if event from the same id appears again within 30 minutes from it last occurrence email will not be sent. NOW I NEED TO GENERATE AN EMAIL AUTOMATICALLY AFTER 30 MINUTES SHOWING THE COUNT OF HOW MANY ALERT OCCURRED IN THE LAST 30 MINUTES WITH THAT ID. HOW CAN WE DO IT.?
You can check for alert action details in the index=_internal sourcetype=splunkd component=sendmodalert [ you may need to check for specific events related to your alerts] and using these events, you can create another alert.
