logeventid + count - monitor Windows Event log if more failed logons

[mzeman81]

Hi,

now I am using in template this kind of trigger logeventid(/Templatename/eventlog[Security,,,,4625,,skip])=1 and it works well,

But if I want to see notification after 3 failed logons how to join it with count?

Thanks.

[mzeman81]

I think that I solve it with count(/Templatename/eventlog[Security,,,,4625,,skip],1m,,)>=3