I have multiple alerts with searches similar to the one below where fields are renamed to a numeric ordering. The search results are passed from phantom to a webex chat which reorders the fields unless this is done.
I am seeing back to back alerts when the throttle should have enacted. This also doesn't occur for all field values. An example would be an alert at 01:10 and 01:11 both containing the same throttled field value.
At a loss at what the cause is. It doesn't appear to be the _'s because I would expect this behavior for all ~20 alerts of this format.
Example search and alert configuration:
Throttle for each result, value: 3_Publication
index=database sourcetype=mssql:replication:status
| fields _time, host, publisher, publication, agent_name, agent_type, agent_status
| eval host = upper(host)
| eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S")
| table Time, host, publisher, publication, agent_name, agent_type, agent_status
| rename Time as 0_Time, host as 1_Host, publisher as 2_Publisher, publication as 3_Publication, agent_name as 4_Agent_Name, agent_type as 5_Agent_Type, agent_status as 6_Agent_Status
