Explanation
Removing throttling fields would not reduce the number of false positives from a correlation search. Throttling fields are the fields that are used to group events and suppress duplicate alerts. For example, if you use src and dest as throttling fields, then the correlation search will only generate one alert per unique pair of src and dest values within the throttling window. This can help reduce the number of false positives by avoiding repeated alerts for the same issue. Removing throttling fields would increase the number of alerts generated by the correlation search, which could include more false positives. The other actions could help reduce the number of false positives by making the correlation search less sensitive or less frequent. Reducing the severity would lower the priority of the alerts and make them less visible. Increasing the throttling window would increase the time interval between alerts for the same issue. Increasing threshold sensitivity would make the correlation search more selective and require more evidence to trigger an alert. References = Configure correlation searches in Splunk Enterprise Security Optimizing correlation searches in Enterprise Security