topic Re: Throttling repeated events in Alerting https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349029#M11952 <P>A good start would be the search that the "correlation rule" that is running and the schedule that's it is running on.</P> Sat, 17 Jun 2017 22:18:08 GMT Richfez 2017-06-17T22:18:08Z Throttling repeated events https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349026#M11949 <PRE><CODE> Even after configuring throttling the same correlation rule is gerating 1000's of incidents every 5 minutes, any idea how to resolve this ? </CODE></PRE> Sat, 17 Jun 2017 15:35:24 GMT https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349026#M11949 arunthomas 2017-06-17T15:35:24Z Re: Throttling repeated events https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349027#M11950 <P>Please post the code, with confidential parts removed or masked, and then maybe we can suggest something.</P> Sat, 17 Jun 2017 17:46:50 GMT https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349027#M11950 DalJeanis 2017-06-17T17:46:50Z Re: Throttling repeated events https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349028#M11951 <P>What you mean by code ?</P> Sat, 17 Jun 2017 17:52:28 GMT https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349028#M11951 arunthomas 2017-06-17T17:52:28Z Re: Throttling repeated events https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349029#M11952 <P>A good start would be the search that the "correlation rule" that is running and the schedule that's it is running on.</P> Sat, 17 Jun 2017 22:18:08 GMT https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349029#M11952 Richfez 2017-06-17T22:18:08Z Re: Throttling repeated events https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349030#M11953 <P>Can you check values of duration and fields to group by for your specific correlation search?<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3071iC8E5EDC019B1220B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 20 Jun 2017 10:30:22 GMT https://community.splunk.com/t5/Alerting/Throttling-repeated-events/m-p/349030#M11953 hardikJsheth 2017-06-20T10:30:22Z