splunk alert every hour with all hits for the search result

[arjangoos]

we want 1 alert if something happens more than 1 time in that hour. But if it happens multiple times we want to see all those events also in the email. And we only want 1 alert in an hour.

alter type: real time
expires: 24 hours

Trigger alert when: number of results is greater than 0 in 1 hours
Trigger: Once

Trottle: yes
Supress triggering for: 1 hours

[ITWhisperer]

How about setting your search to run every hour looking back an hour and triggering if there are any results?