This environment variable is used to set the maximum number of field values that may be stored for each alert — that is to say, each that is using field-based throttling.

If you discover that such alerts are triggered with the same field value before the throttle period has elapsed, you may want to increase the limit with the ALERT_MAX_THROTTLE_FIELD_VALUES_STORED variable. Below is an example of how this environment variable might be set:

ini files

This sets the limit to 100, which is the default.

When an alert is triggered, Humio will store the value of the throttle field in memory. To limit memory usage, there is a fixed limit on the number of values that Humio stores per alert. If you select a throttle field that expects more values than this limit, your alert might trigger more frequently than indicated by the given throttle period.

Related to cluster management, be aware that increasing the limit might also increase the memory usage of every node in the cluster.