i want to suppress alert for next 4 hours
i am trying to use throttle along with each result trigger condition
splunk query result has more than 10 result as output but i am getting on only one. so throttle is suppressing each result trigger condition which is not working as expected any thoughts on this
Attaching screen shot.
| ldapsearch basedn="DC=hhgg,DC=hhggcom,DC=com" search="(&(manager=CN=HHG6784,OU=DUHF58,OU=HGKK85,OU=IN,OU=Internal,OU=Personal Accounts,DC=hhgg,DC=hhggcom,DC=com)(useraccountcontrol=514))" attrs=* | eval source_name = "ADPROD" | eval object_name = cn |eval msg_body = "Account " + object_name + " is disabled in Active Directory" | eval useraccountcontrol = userAccountControl