Why am I getting multiple email notices per minute from Splunk?

[usbamuchmore]

I have inherited a medium install of Splunk, and for the most part, I understand everything. But, a simple account locked alert is sending multiple, multiple email notices per minute, and I don't understand why. I'll include a screenshot so anyone who sees something let me know. The purpose is to check for real-time account lockouts and notify only once.

[usbamuchmore]

Perfect guys thank you!

[richgalloway]

In addition to the great answer from @Vijeta, turn on throttling. This keeps Splunk from generating additional alerts for the same event(s) for a period of time. To do that, click on the "Throttle" box, complete the form, and click Save.

[usbamuchmore]

The throttling did it, thank you, guys!

[Vijeta · Accepted solution]

Probably its because of real-time alert. You can schedule it to run every 1 min for the window of last 60 seconds i.e. 1 minute.

[usbamuchmore]

Ok good. Thank you, clearly, I'm very new to Splunk in general.