Evaluate search based on one index

KDWilk — Tue, 26 Sep 2023 19:38:46 GMT

I would like help with creating the following.

Search when account was created and return a list of users who have not authenticated 30 days after account was created.

I have a search to show details for a particular user, but I would like to create a list of all users and set an alert if not authenticated after 30 days.

index=duo

object=<user1> OR username=<user1>

| eval _time=strftime(_time,"%a, %m/%d/%Y %H:%M")

| table _time, object, factor, action, actionlabel, new_enrollment, username | rename object AS "Modified User", username AS "Actioned By" | sort _time desc

So if actionlabel="added user' exists, I would like to return new_enrollment=false

Object(actionlabel=added user) = username(new_enrollment=false)

Here's how the output I'm searching for

User	Created	Authentications since created (After 31 days)	Last Authentication
user1	7/25/2023	0
user2	7/27/2023	3	8/19/2023

Re: Evaluate search based on one index

bowesmana — Wed, 27 Sep 2023 04:04:03 GMT

Your table shows user2 that authenticated less than 30 days after creation, so do you want this in the output? What does "Authentications since created (After 31 days)" in your table as user2 has a positive value, but the last date within 30 days.

If you're looking to find users who were created 31 days ago, but have not logged in since, then you would use this type of search, where you need to work out what is a login event and what is a created event so you can determine the logic for event_is_login in the examplke below.

index=duo earliest=-31d@d latest=@d INCLUDE_CREATED_EVENTS_AND_LOGIN_EVENTS | eval created=if(actionlabel="added user" AND _time < relative_time(now(), "-3d@d"), _time, 0) | where created=1 OR event_is_login | stats count(eval(if(event_is_login), 1, null()))) as Logins max(eval(if(event_is_login), _time, null()))) as LastLogin max(created) as created_time by object | rename object AS User | eval LastLogin=strftime(LastLogin, "%m/%d/%Y")

What state in your data indicates that the user was created, is it actionlable="added user"?

topic Evaluate search based on one index in Getting Data In

Evaluate search based on one index

Re: Evaluate search based on one index