Splunk Account Lockout

[OsmanElyas]

I have just configured Splunk and I have alert running for locked account.

It keep generating multiple entries from per lockout account 

So I want to generate one message incase of account get locked

index=wineventlog source="WinEventLog:Security" sourcetype=WinEventLog action=failure Account_Name="*" user="*" AND "taskcategory=Account Lockout"

[richgalloway]

What you want is to throttle the alert.  Throttling prevents the alert from firing too often.  To turn on throttling, edit the alert and check the box labled "Thottle" then specify how long you want Splunk to wait before firing the alert again.

[OsmanElyas]

@richgalloway  Thank you for the guide I am still facing small issue 

what should be in the filed Suppress results containing field value when I click on throttle.

[richgalloway]

Use a field name that uniquely identifies the specific alert you wish to throttle.  In this case, that field would be Account_Name since you don't want repeated alerts for users.

[OsmanElyas]

@richgalloway  Much appreciate your support, I have implemented the report.

[richgalloway · Accepted solution]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.