When you say multiple notables, do you mean notable events generated when the same correlation search runs again, or notable events generated by a different correlation search?
In the first case, you should review the frequency of the alert and the time range it covers. If the alert runs hourly but searches over a 4 hour period, this can potentially alert on the same event 4 times. E.g. if the search condition matches at 12:05, this event would alert at 13:00, 14:00, 15:00 and 16:00 as these 1 hour intervals are all within the 4 hour search period.
If you are intentionally including some overlap, you can use a window duration of 4 hours based on fields you want to group by - typically the fields that uniquely define the alert. E.g. if alerting on source and destination IP address, you would group by these fields to prevent the same combination from triggering additional alerts.
In the second case, where different correlation searches are triggering on the same events, you likely need to tune your searches. If search A1 is returning event A and search A2 is also returning event A, your searches are likely too broad. Try keeping the search as restrictive as possible, including only the field values you need. If this is not possible, you can filter using where, or using NOT to exclude matching on field values, lookups or subsearches.
If you still can't figure out why your searches may be triggering multiple times, please include them here along with their schedule(s), and current windows and grouping fields (if applied).
