topic Re: Throttle condition is suppressing each result output in Getting Data In

Throttle condition is suppressing each result output

rahulg — Tue, 02 Nov 2021 06:31:44 GMT

i want to suppress alert for next 4 hours

i am trying to use throttle along with each result trigger condition

splunk query result has more than 10 result as output but i am getting on only one. so throttle is suppressing each result trigger condition which is not working as expected any thoughts on this

Attaching screen shot.

Re: Throttle condition is suppressing each result output

isoutamo — Tue, 02 Nov 2021 07:55:38 GMT

Can you post also your SPL?

Re: Throttle condition is suppressing each result output

rahulg — Tue, 02 Nov 2021 09:56:27 GMT

| ldapsearch basedn="DC=hhgg,DC=hhggcom,DC=com" search="(&(manager=CN=HHG6784,OU=DUHF58,OU=HGKK85,OU=IN,OU=Internal,OU=Personal Accounts,DC=hhgg,DC=hhggcom,DC=com)(useraccountcontrol=514))" attrs=* | eval source_name = "ADPROD" | eval object_name = cn |eval msg_body = "Account " + object_name + " is disabled in Active Directory" | eval useraccountcontrol = userAccountControl