Several log on attempts failed - trigger not working

[Sara.Art]

Hi! I have this trigger:

{HOST:eventlog[Security,,,,4625,,skip].logeventid(4625)}=1

that monitors failed login on server. It works, but I need to tell the trigger to alert me when there are e.g. 5 attempts in 3 minutes. I tried this {HOST:eventlog[Security,,,,4625,,skip].count(3m,"4625",regexp)}>=5 but it does not work. How can I fix it? What am I doing wrong? I thank You all in advance. Have a nice day, Sara

[Hamardaban]

I think it will be enogh for you to use the following expression: {HOST:eventlog[Security,,,,4625,,skip].count(3m)}>=5 since the item itself has already selected the desired values of logeventid.

[Sara.Art]

Thanks a lot Hamardaban!!! It works :-) have a nice day, Sara