topic Email user if windows session is X days old in Splunk Search https://community.splunk.com/t5/Splunk-Search/Email-user-if-windows-session-is-X-days-old/m-p/564662#M196693 <P>I am trying to set up an alert in Splunk that will email a user whenever their Windows session is X days old. It would be across multiple hosts/users and use the security event log to determine if there hasn't been a 4647 or 1074 event since their 4624 logon event.&nbsp;</P><P>Has anyone set up something similar?</P><P>Thanks in advance!</P> Wed, 25 Aug 2021 09:16:31 GMT splunky_monkey 2021-08-25T09:16:31Z Email user if windows session is X days old https://community.splunk.com/t5/Splunk-Search/Email-user-if-windows-session-is-X-days-old/m-p/564662#M196693 <P>I am trying to set up an alert in Splunk that will email a user whenever their Windows session is X days old. It would be across multiple hosts/users and use the security event log to determine if there hasn't been a 4647 or 1074 event since their 4624 logon event.&nbsp;</P><P>Has anyone set up something similar?</P><P>Thanks in advance!</P> Wed, 25 Aug 2021 09:16:31 GMT https://community.splunk.com/t5/Splunk-Search/Email-user-if-windows-session-is-X-days-old/m-p/564662#M196693 splunky_monkey 2021-08-25T09:16:31Z