Getting Data In

Throttle condition is suppressing each result output

rahulg
Explorer
 

i want to suppress alert for next 4 hours

i am trying to use throttle along with each result trigger condition

splunk query result  has more than 10 result as output but i am getting on only one. so throttle is suppressing each result trigger condition which is not working as expected any thoughts on this

Attaching screen shot. 

rahulg_1-1635834613212.png

 

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you post also your SPL?
0 Karma

rahulg
Explorer

| ldapsearch basedn="DC=hhgg,DC=hhggcom,DC=com" search="(&(manager=CN=HHG6784,OU=DUHF58,OU=HGKK85,OU=IN,OU=Internal,OU=Personal Accounts,DC=hhgg,DC=hhggcom,DC=com)(useraccountcontrol=514))" attrs=* | eval source_name = "ADPROD" | eval object_name = cn |eval msg_body = "Account " + object_name + " is disabled in Active Directory" | eval useraccountcontrol = userAccountControl

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...