ntevl, set the Suppression Key, Optional Key to $event_id in the ntevl 'Event Selection' window.
Also, the following fields can be used for the establish a cutoff point of generating the Alarm.
Setup > Profiles > Alarm/Post > Set Suppression Key, Optional Key
- Time Frame: 1 min
- Event Count: > 3
To test it you can send some messages with the configured event ids but note that when using this Microsoft eventcreate utility it has to be less than 1000 for the event id just during the testing.
eventcreate /T ERROR /ID 400 /d "Create event for testing"
Once you enable the Suppression Key under 'Alarm / Post' and add $event_id as the value, then separate/individual alarms will be generated and not grouped together which increases the alarm count despite the event id's under Event Selection being different.