Throttle condition is suppressing each result output

[rahulg]

i want to suppress alert for next 4 hours

i am trying to use throttle along with each result trigger condition

splunk query result  has more than 10 result as output but i am getting on only one. so throttle is suppressing each result trigger condition which is not working as expected any thoughts on this

Attaching screen shot. 

rahulg_1-1635834613212.png

[isoutamo]

Can you post also your SPL?

[rahulg]

| ldapsearch basedn="DC=hhgg,DC=hhggcom,DC=com" search="(&(manager=CN=HHG6784,OU=DUHF58,OU=HGKK85,OU=IN,OU=Internal,OU=Personal Accounts,DC=hhgg,DC=hhggcom,DC=com)(useraccountcontrol=514))" attrs=* | eval source_name = "ADPROD" | eval object_name = cn |eval msg_body = "Account " + object_name + " is disabled in Active Directory" | eval useraccountcontrol = userAccountControl