Hi L1mLam, Just use field name in this option and it will work More information around alert suppression configuration attributes can be found here - https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Savedsearchesconf#alert_suppression.2Fseverity.2Fexpiration.2Ftracking.2Fviewing_settings alert.suppress.fields = <comma-delimited-field-list> * List of fields to use when suppressing per-result alerts. This field *must* be specified if the digest mode is disabled and suppression is enabled. * Default: empty string.   ------ An upvote would be appreciated and Accept Solution if it helps! ... View more

@richgalloway that's a very good point!  600 secs is 10 mins - apologies for the confusion.    I used that example as someone provided this to me within my organisation but you're right that this should be set to 300 for 5 mins.  Incidentally, for the suppression period I don't think that it makes much difference as both values should ensure that the next alert is outside of the 5 minute cron schedule checkpoint window. I didn't yet "Accept as Solution" until I have validated this in my test environment, as alluded in my earlier comment. ... View more