If you want to check for values at some regular interval, recommend using the Timer App. We use it to schedule playbooks at a couple of intervals, based on label, similar to your own. This way your playbook can gracefully end. and pick up again when this new "Timer" container is made. You will need to use some custom code to pull up containers with this "NULL" or "NOTNULL" user or whatever.  Definitely don't ever do sleep or keep playbooks open all the time that are checking for values that are or are not there. phanotm_mhike is right, it will DOS your instance!     ... View more

Our naming Convention: (Prod/Development/Depracated) - (Utility / Reporting / Enhancement)  - (Active / null) - (Notable Name / Description) So PRD-UTL-Active-SplunkES Ack or DEV-RPT-Threat Malware Emailed to Users ... View more