Evaluate search based on one index

[KDWilk]

I would like help with creating the following.

Search when account was created and return a list of users who have not authenticated 30 days after account was created.

I have a search to show details for a particular user, but I would like to create a list of all users and set an alert if not authenticated after 30 days.

index=duo

object=<user1> OR username=<user1>

| eval _time=strftime(_time,"%a, %m/%d/%Y %H:%M")

| table _time, object, factor, action, actionlabel, new_enrollment, username | rename object AS "Modified User", username AS "Actioned By" | sort _time desc

So if actionlabel="added user' exists, I would like to return new_enrollment=false

Object(actionlabel=added user) = username(new_enrollment=false)

Here's how the output I'm searching for 

User	Created	Authentications since created (After 31 days)	Last Authentication
user1	7/25/2023	0
user2	7/27/2023	3	8/19/2023

[bowesmana]

Your table shows user2 that authenticated less than 30 days after creation, so do you want this in the output? What does "Authentications since created (After 31 days)" in your table as user2 has a positive value, but the last date within 30 days.

If you're looking to find users who were created 31 days ago, but have not logged in since, then you would use this type of search, where you need to work out what is a login event and what is a created event so you can determine the logic for event_is_login in the examplke below.

index=duo earliest=-31d@d latest=@d INCLUDE_CREATED_EVENTS_AND_LOGIN_EVENTS
| eval created=if(actionlabel="added user" AND _time < relative_time(now(), "-3d@d"), _time, 0)
| where created=1 OR event_is_login
| stats count(eval(if(event_is_login), 1, null()))) as Logins 
        max(eval(if(event_is_login), _time, null()))) as LastLogin
        max(created) as created_time
        by object
| rename object AS User
| eval LastLogin=strftime(LastLogin, "%m/%d/%Y")

What state in your data indicates that the user was created, is it actionlable="added user"?