Splunk triggers an alert but shouldn't

[ESIMatNeforce]

Hello,

I have implemented an correlation search, where I want to find "Brute Force Behavior" and afterwards an "User was added to Domain Admins" Event with the following search:

(EventCode=4625 "bad password") OR (EventCode=4624 successfully Logon_Type=10) OR (EventCode=4728 "A member was added to a security-enabled*") | eval Account_Name=mvfilter(Account_Name!="-") | eval Account_Name = lower(Account_Name) | transaction Account_Name maxspan=2m endswith=(EventCode=4728 "A member was added to a security-enabled*") | where eventcount>=7

I have saved this search as an alert

When I test and do false logins followed by a real login this alert triggers (this alert shouldn't trigger at this moment because no member was added to a security-enabeld group") and I get an email notification. When I look up the alarm afterwards splunk does not find any result, as it should.

So why do I get an alarm when the search doesn't find anything? and does anyone know how to fix this issue?

best regards
ESIMatNeforce

[LiquidTension]

This might be way to simple, but is it possible that you have the alert condition set to "always" rather than something like "if number of events is greater that X"