I have a Splunk search which detect some potential attack Ips.
The alert scheduled every 4 hours and detect the offending IPs for last 24 hour which tried to login but failed for multiple times.
The result could be something like the following example:
The problem is that, let's say the alert triggered at 8:00 am for the above result.
At 12:00 am, the alert triggered again with the following result:
How could i exclude the previous result which already existing and only put the new one?
What i need for the alert at 12:00 am is only show:
I tried to use Throttle to suppress results containing field value of ip, but this only works as per result, which means i would got multiple emails.