I figured out a workaround to this. By adding the following to the end of my correlation rule it checks the suppressed eventtypes first to see if there are anything that is suppressed with matching fields. If it find anything with matching fields that hasn't expired it doesn't return any results so the emails/tickets/notable/adaptive response actions are not triggered. | search NOT [ | 'suppression_eventtypes ' | eval _raw = search | extract | search source = "insert correlation rule name here" | eval tnow = now() | where tnow > start_time AND tnow ] suppression _eventtypes is a macro.. | rest splunk_server=local count=0 /services/saved/eventtypes | search title=notable_suppression* | rename title as eventtype | rex field=eventtype "notable_suppression-(?.+)" | rex field=search "_time>=?(?\d+)" | rex field=search "_time<=?(?\d+)" ... View more