I am coming across an interesting problem where notables are being generated for each event in Splunk with unique notable IDs, despite trigger conditions being set and notables being set to "Trigger Once".
For example, if we are looking for 5 or more failed user login events over the span of 10 minutes, we will receive 5 notable alerts in our queue for each event, despite having counts set to >=5 and other trigger conditions set, and having trigger set to "once" as opposed to "for each result". It seems like even when the trigger is set to "once", it is still behaving as if it is set to "for each result"
Is there a way to set trigger conditions using SPL itself so that only one notable event is generated for a query that yields multiple results so we will only receive one notable?
