Suppress triggering

[sarit_s]

Hello

I'm trying to set an alert which will fired only after the second time the threshold is reached.

i set Throttle with Suppress triggering of 5 min

but the alert is fired after the first time

what should i do ?

[isoutamo]

Hi

can you change your alert query to use streamstats with window and then raise it if count is > 1?

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Streamstats

r. Ismo

[sarit_s]

did you mean something like this?

 | streamstats count by host window=5

with window there are no results

what value should i set in window ?