I would like help with creating the following. Search when account was created and return a list of users who have not authenticated 30 days after account was created. I have a search to show details for a particular user, but I would like to create a list of all users and set an alert if not authenticated after 30 days. index=duo object=<user1> OR username=<user1> | eval _time=strftime(_time,"%a, %m/%d/%Y %H:%M") | table _time, object, factor, action, actionlabel, new_enrollment, username | rename object AS "Modified User", username AS "Actioned By" | sort _time desc   So if actionlabel="added user' exists, I would like to return new_enrollment=false   Object(actionlabel=added user) = username(new_enrollment=false)   Here's how the output I'm searching for    User Created Authentications since created (After 31 days) Last Authentication user1 7/25/2023 0   user2 7/27/2023 3 8/19/2023 ... View more