[This is preliminary documentation and subject to change.]
The HAVING COUNT clause sets a minimum limit on the number of discrete events that produce an aggrevate event, reducing overall event traffic. The HAVING COUNT clause is used after the GROUP BY clause:
select… <where_clause>
<GROUP BY proplist> <HAVING COUNT operator constant>
The HAVING COUNT operator is one of the operators that are valid in the SELECT statement. The constant is an unsigned integer. For example, the following statement returns notifications of instance modification events if more than 25 events occur during a 10 second interval:
select * from __InstanceModificationEvent
where TargetInstance isa Win32_LogicalDisk
group by DriveLetter within 10 having count > 25