Is there any git repo where you posted your script ? Thanks. ... View more

a bit more accurate, and as we are linked with the LDAP we are able to have specific information related to the user (i.e. email ...) index=_audit action="search" search="" NOT search="'|" user!="admin" user!="splunk-system-user" apiStartTime='ZERO_TIME' apiEndTime='ZERO_TIME' | table _time, user, apiStartTime, apiEndTime | stats count by user | table user, count | sort - count | join type=left user [| rest splunk_server=local /services/authentication/users/ | table email, title | rename title as user] | table user, count, email ... View more

This works for us index=_audit action="search" search="*" | where user!="admin" | table _time, user, apiStartTime, apiEndTime | search apiStartTime='ZERO_TIME' apiEndTime='ZERO_TIME' | timechart limit=0 count by user We are now able to alert these users directly thru email. ... View more