Send email if one event happens but the other doesn't after 24 hours

[mrmc]

I'm attempting to craft an alert that notifies myself and the user that requested access that they haven't revoked their access to a support site. My tool writes to splunk that they requested access, and then that they revoked access. But, if they forget to revoke access, I'd like to notify them that they forgot after 24 hours.

User johndoe (ID: 123) requested access to the site (ID: 123) located at http://subdomain.example.com.

User johndoe (ID: 123) revoked their access to the site (ID: 123) located at http://subdomain.example.com.

I'm a splunk noob, so I apologize if this is a pretty straightforward answer and I really appreciate the help.

[woodcock · Accepted solution]

Like this:

... | rex "User\s+(?<user>\S+).*?(?<action>requested|revoked)" | stats latest(_time) AS time latest(action) AS action BY user | eval age=now()-time | where age>(24*60*60) AND action=requested

[mrmc]

Thanks for this! They can request access to different sites, and we only want to notify if they haven't revoked access to those specific sites. Is there a way to extend the regex to match the site ID too?

[woodcock]

Like this:

... | rex "User\s+(?<user>\S+).*?(?<action>requested|revoked).*?site\s+\(ID:\s+(?<siteID>[^\)]+)" | stats latest(_time) AS time latest(action) AS action BY user siteID | eval age=now()-time | where age>(24*60*60) AND action=requested

[mrmc]

@woodcock, I'm experiencing the following error:

Error in 'rex' command: Encountered the following error while compiling the regex 'User\s+(?\S+).*?(?)requested|revoked).*?site\s+\(ID:\s+(?[^\)]+)': Regex: unmatched parentheses

I know the error is somewhere near .*?(?)requested|revoked). I'm just not sure where to put the extra parentheses. Could you help?

[woodcock]

Sorry, I had a typo but I went back and fixed (re-edited) all the answers and it should all work now.

[mrmc]

Thank you so much, this will work excellent!