For my other alerts that worked, for some reason this one refuses to set off.  It's like it doesn't recognize the results as results. I'm using an email alert to my email and checked my triggered alerts page, I did not see it on there. ... View more

I ran out of time to properly test "rise by 1".  I couldn't even get $result.USER_ID$ in the alert message to work. I ended up just triggering for each result and suppressing the alert for 24 hours.  If anything I'll have to come back in the future and learn more/work on this.  I appreciate the help! ... View more

This happened to me as well.  It could be that your Splunk Integration User had "Manage Users" removed from it's permissions, which is needed to view the LoginHistory object. Our workaround was to use the User object and LoginEvent to retrieve the same type of data. ... View more