https://community.splunk.com/t5/Getting-Data-In/Searching-events-after-log/m-p/525778#M88740 <P>Hello,</P><P>I would like to create the alert that:</P><P>someone login to system (event login = successful login) and I just want to check if in 5 min from this event, was any user or group was created by user (which is not member of admin group).</P><P>or another version:</P><P>If X notification was triggered +&nbsp; notification about new user or new group was triggered (created not by admin)- but 1h before and 1h after notification X (timestamp), then: generate alert</P><P>Could you please provide some tips for this case?</P><P>&nbsp;</P><P>Best regards,</P><P>Jacob</P> Wed, 21 Oct 2020 13:37:46 GMT JacobWrdz 2020-10-21T13:37:46Z https://community.splunk.com/t5/Getting-Data-In/Searching-events-after-log/m-p/525778#M88740 <P>Hello,</P><P>I would like to create the alert that:</P><P>someone login to system (event login = successful login) and I just want to check if in 5 min from this event, was any user or group was created by user (which is not member of admin group).</P><P>or another version:</P><P>If X notification was triggered +&nbsp; notification about new user or new group was triggered (created not by admin)- but 1h before and 1h after notification X (timestamp), then: generate alert</P><P>Could you please provide some tips for this case?</P><P>&nbsp;</P><P>Best regards,</P><P>Jacob</P> Wed, 21 Oct 2020 13:37:46 GMT https://community.splunk.com/t5/Getting-Data-In/Searching-events-after-log/m-p/525778#M88740 JacobWrdz 2020-10-21T13:37:46Z