How to Configure Alert Throttling for Failed Login Attempts from Same Source IP
A security analyst wants to create a saved search that triggers an alert when more than 100 failed login attempts occur within a 5-minute window from the same source IP. The search should run every 5 minutes and alert only once per window. Which setting should be configured?
Quick Answer
The correct answer is to enable Throttle with a 5-minute window on the source IP field. This configuration directly addresses the need to configure alert throttling to avoid duplicate alerts by suppressing subsequent notifications for the same source IP within the defined window, ensuring the alert fires only once per 5-minute interval even if the threshold is repeatedly exceeded. On the Splunk SPLK-1003 exam, this tests your understanding of alert scheduling and throttling mechanics—a common trap is confusing the throttle window with the search time range or forgetting to specify a field to throttle on, which would suppress all alerts globally rather than per source IP. The key distinction is that throttling without a field collapses all results into a single alert, while throttling on source IP preserves per-IP granularity. Memory tip: think of throttling as a "cool-down timer" for each unique IP—once the alarm rings, that IP goes silent until the timer resets.
⚠ Common exam trap
Many exam-takers confuse throttling with alert conditions or time windows, mistakenly thinking that setting a rolling time window or result count alone will prevent duplicate alerts, when in fact throttling is the specific mechanism designed to suppress repeated alerts based on field values.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.
Enabling Throttle with a 5-minute window on the source IP field ensures that once an alert fires for a given source IP, subsequent alerts from that same IP are suppressed for the duration of the throttle window. This matches the requirement to alert only once per 5-minute window per source IP, preventing alert fatigue while still detecting the threshold breach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Digest mode' with a time window of 5 minutes.
Why it's wrong here
Digest mode sends a single alert with all results, but doesn't throttle per IP.
- ✗
Configure the search to use a 'Real-time' window of 5 minutes and set 'Alert on' to 'Result count'.
Why it's wrong here
Real-time window is not appropriate for a scheduled search, and doesn't provide throttling.
- ✗
Set the 'Alert condition' to 'Number of results > 100' and use a rolling time window of 5 minutes.
Why it's wrong here
This only defines the trigger condition, not suppression.
- ✓
Enable 'Throttle' and set the throttle window to 5 minutes, throttling on the source IP field.
Why this is correct
This suppresses duplicate alerts for the same IP within 5 minutes.
Go deeper
Related to this question
About these practice questions
This SPLK-1002 question is part of Courseiva's 475-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SPLK-1002
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst sets up a saved search alert to trigger when more than 100 failed logins occur in 5 minutes. To avoid alert fatigue, they want to suppress the alert if the number of failed logins is the same as the previous evaluation. Which alert action setting should they configure?
medium- A.Enable 'Alert throttling' based on the 'src' field.
- ✓ B.Enable 'Alert suppression' and set 'Suppress if results are the same as the previous search'.
- C.Set the 'Throttle' field to suppress alerts for a specified time window.
- D.Configure 'Alert severity' to low and set a delay.
Why B: 'Alert suppression' with the setting 'Suppress if results are the same as the previous search' directly addresses the requirement to avoid alert fatigue when the number of failed logins is unchanged. Option A, 'Alert throttling', limits the frequency of alerts based on a time interval or field values, not comparison of result sets. Option C's throttle field is typically for throttling per field value, not condition-based suppression. Option D's severity and delay do not suppress based on result comparison.
Variation 2. A saved search is configured to run every 5 minutes and send an alert when the count of failures exceeds 10. After several days, users report they are not receiving alerts even though failures are occurring. The saved search runs successfully and produces results. What is the most likely cause?
medium- A.The saved search owner does not have permission to send alerts.
- B.The alert action is not configured to send to the intended recipients.
- ✓ C.Alert throttling is enabled and suppressing subsequent alerts.
- D.The alert condition is set to trigger when count is less than 10.
Why C: Alert throttling is designed to suppress duplicate alerts within a specified time period. If throttling is enabled, even though the saved search runs every 5 minutes and the condition (count of failures > 10) is met, only the first alert is sent. Subsequent alerts are suppressed until the throttle window resets, explaining why users stop receiving alerts despite ongoing failures. The search runs successfully, so permissions and alert action configuration are not the issue, and the condition is correctly set to exceed 10, not less than 10.
Variation 3. An alert saved search runs every 5 minutes and is set to trigger when count > 0. The alert keeps triggering repeatedly for the same events. What is the recommended solution?
easy- A.Set the alert to trigger once per hour.
- B.Disable the alert and re-enable.
- ✓ C.Increase the alert throttle period.
- D.Change the condition to count > 1.
Why C: Increasing the alert throttle period suppresses duplicate alerts for the same events within a defined time window, preventing repeated triggers. Option A reduces frequency but does not address duplicate alerts. Option B does not solve the underlying issue. Option D may miss legitimate events.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.