I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0. host=myHostHere sourcetype=lastlog | multikv fields USERNAME | where USERNAME = "user1" OR USERNAME = "user2" | table host USERNAME ... View more

The issue was related to inconsistencies in the files: /etc/hostname and /etc/hosts regarding the machine name, since the inputs.conf file in $SPLUNK_HOME/etc/system/local references a specific name, which was different from the one in the 2 files mentioned above. ... View more