Possible to have a dual realert key?

[roman-tasi]

Here's the scenario I'm facing:

I have a realert period of 30 minutes. I need to send a new alert if one in the combination of the file field and the user field differs. For example:

file: Viber.exe
user: john
--- alert is sent

file: Viber.exe
user: john
--- alert is not sent because 30 minutes is not up

file: Viber.exe
user: bob
--- alert is sent because bob differs from john

file: Viber.exe
user: bob
--- alert is not sent because 30 minutes is not up

file: Slack.exe
user: bob
--- alert is sent because Slack.exe differs from Viber.exe

Is this possible to accomplish?

[jertel]

I recommend reviewing the query_key documentation.