Getting Data In

Throttle condition is suppressing each result output

rahulg
Explorer
 

i want to suppress alert for next 4 hours

i am trying to use throttle along with each result trigger condition

splunk query result  has more than 10 result as output but i am getting on only one. so throttle is suppressing each result trigger condition which is not working as expected any thoughts on this

Attaching screen shot. 

rahulg_1-1635834613212.png

 

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you post also your SPL?
0 Karma

rahulg
Explorer

| ldapsearch basedn="DC=hhgg,DC=hhggcom,DC=com" search="(&(manager=CN=HHG6784,OU=DUHF58,OU=HGKK85,OU=IN,OU=Internal,OU=Personal Accounts,DC=hhgg,DC=hhggcom,DC=com)(useraccountcontrol=514))" attrs=* | eval source_name = "ADPROD" | eval object_name = cn |eval msg_body = "Account " + object_name + " is disabled in Active Directory" | eval useraccountcontrol = userAccountControl

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...