I have just configured Splunk and I have alert running for locked account.
It keep generating multiple entries from per lockout account
So I want to generate one message incase of account get locked
index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog action=failure Account_Name="*" user="*" AND "taskcategory=Account Lockout"
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
What you want is to throttle the alert. Throttling prevents the alert from firing too often. To turn on throttling, edit the alert and check the box labled "Thottle" then specify how long you want Splunk to wait before firing the alert again.
@richgalloway Thank you for the guide I am still facing small issue
what should be in the filed Suppress results containing field value when I click on throttle.
Use a field name that uniquely identifies the specific alert you wish to throttle. In this case, that field would be Account_Name since you don't want repeated alerts for users.
@richgalloway Much appreciate your support, I have implemented the report.
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.