I submitted doc feedback for you earlier today and here is the response I received. The “Per-result” option depends on the value of fields you specify. It works as an AND. So, for example: If you have two fields, say “userID” and “URL,” specified in your search, and the search you run returns events where logins failed, say the value is “FAILED”. If you specify “userID” and “URL” in your throttle, an alert will not trigger if those two field values are returned as “FAILED”. It will alert if only one field returns as “FAILED” but the other returns a different value. ... View more