How to Create an Alert if Multiple Members of a Group are down

Use the Select Count command. There are a few examples you can find on Thwack below is one. 

(+) SWQL for status count in multiple columns from same table - Forum - Network Performance Monitor (NPM) - THWACK (solarwinds.com)

I found this example which I thought I could adapt to fit my use case. This runs fine and returns groups where 5 or more members are down. As you can see it has a subquery.

SELECT Groups.Uri, Groups.DisplayName FROM Orion.Groups AS Groups
WHERE Groups.ContainerID IN (
 SELECT g.ContainerID
 FROM Orion.Groups g
 WHERE g.Members.Status = 2 -- Down status
 AND g.Members.MemberEntityType = 'Orion.Nodes'
 GROUP BY g.ContainerID
 HAVING COUNT(g.Members.MemberPrimaryID) >= 5
)

That's a decent start but I need to filter out nodes that are muted and that have a specific custom property. So I adapted as below but when I run this I get an error saying subqueries are not supported.

SELECT Groups.Uri, Groups.DisplayName FROM Orion.Groups AS Groups
WHERE Groups.ContainerID IN (
SELECT g.ContainerID
FROM Orion.Groups g
LEFT JOIN Orion.AlertSuppression a ON a.EntityUri = g.Members.MemberUri
INNER JOIN Orion.Container c ON c.ContainerID = g.ContainerID
INNER JOIN Orion.NodesCustomProperties ncp ON ncp.Node.Uri = g.Members.MemberUri
WHERE g.members.MemberEntityType = 'Orion.Nodes'
AND ncp.AlertingRuleSet = 'Prod'
AND g.Name = 'Production'
AND g.Members.Status = 2
AND a.ID IS NULL 
GROUP BY g.ContainerID
HAVING COUNT(g.Members.MemberPrimaryID) >= 2
)

Have you tried doing a mix of the regular GUI type alert on the top and adding a subsection with the SWQL at the bottom? This is as close as an example as I can show but it should work for Group alerts too. This is mixing Node down AND Snmp Traps into the same alert but should allow some more filtering for you. May be this can get you around some of the SWQL limitations.

Here is the GUI main part 

And the subsection part of the alert 

Thanks, that gave me a way of doing it without even having to use SWQL. First section selects the group with "condition must exist" and "alert can be triggered if" left unchecked. Second section selects nodes which have a specific custom property and has the "condition must exist" set to 4h and "alert can be triggered if more than or equal to 5". Testing with a shorter time and fewer down nodes (to match the current number of nodes that are down) confirmed it's working now.

Thanks, that gave me a way of doing it without even having to use SWQL. First section selects the group with "condition must exist" and "alert can be triggered if" left unchecked. Second section selects nodes which have a specific custom property and has the "condition must exist" set to 4h and "alert can be triggered if more than or equal to 5". Testing with a shorter time and fewer down nodes (to match the current number of nodes that are down) confirmed it's working now.