Typically the way to track state in Splunk is via a lookup table.
Create a lookup with two fields -- user
and firstSeen
.
Then, do one of the following:
Create two searches. The first just maintains the lookup table, and the second does your alerting based on a search using inputlookup
instead of querying the indexed data.
Create one search that pulls in your new events and the lookup table both, then outputs the updated lookup table, then filters the results to recent entries. Trigger the alert if any are found with firstSeen > now()-xx seconds.
Thanks, I'll try to work with lookup tables.
Regards,
Rafael