Using the _time field for throttling within the correlation search.

[AL3Z]

Hi all,

In my AD computer account deletion correlation search, I use _time and subjectusername in throttling fields for grouping. Is adding _time to throttling the correct approach? Please correct me if I'm wrong.
query 
index=win sourcetype=XmlWinEventLog EventCode=4743
| bin _time span=5m
| stats values(EventCode) as EventCode, values(signature) as EventDescription, values(TargetUserName) as deleted_computer,  dc(TargetUserName) as computeruser_count by _time SubjectUserName
| where computeruser_count > 20
Time Range set to 
Earliest Time 20m@m
latest now
cron schedule */15 * * * *

Scheduling  set to Continuous

Throttling 
window duration 12 hours

Fields to group by SubjectUserName , _time

Thanks in Advance..

[richgalloway]

Throttling works by checking to see if the specified field changed value within the throttle period.  Since _time is always changing it is ineffective as a throttle.

[AL3Z]

@richgalloway ,

I need to change the query or its fine to drop the _time from the Throttling group by field name?

[richgalloway]

I would drop _time as a throttling field.