From v3.91, the logmon probe has the ability to send an alarm only if the monitored string occurs x times. I'm referring to the Variable Exceed Alarm Minimum Match Count field on the Watcher Rules Alarm tab. What time frame does this field relate to?
CA UIM any version logmon probe superior to 3.91
Every polling cycle/interval, the Minimum Match Count option counts the occurrences and generates an alarm when the threshold is >= the set value. For instance, if you are searching for the word 'error' and have the Miminum Match Count set to 3, then each polling cycle it must match the word 'error' 3 times before an alarm will be sent.
Please note that this variable is only applicable for the Update and Command modes. Setting the alarm disables the watcher rules.