Splunk Enterprise

Splunk Account Lockout

OsmanElyas
Explorer

I have just configured Splunk and I have alert running for locked account.

It keep generating multiple entries from per lockout account 

So I want to generate one message incase of account get locked

 

index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog action=failure Account_Name="*" user="*" AND "taskcategory=Account Lockout"

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you want is to throttle the alert.  Throttling prevents the alert from firing too often.  To turn on throttling, edit the alert and check the box labled "Thottle" then specify how long you want Splunk to wait before firing the alert again.

---
If this reply helps you, Karma would be appreciated.
0 Karma

OsmanElyas
Explorer

@richgalloway  Thank you for the guide I am still facing small issue 

what should be in the filed Suppress results containing field value when I click on throttle.

 

 
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use a field name that uniquely identifies the specific alert you wish to throttle.  In this case, that field would be Account_Name since you don't want repeated alerts for users.

---
If this reply helps you, Karma would be appreciated.
0 Karma

OsmanElyas
Explorer

@richgalloway  Much appreciate your support, I have implemented the report.

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...