Search query to return any account creations over a 24 hour period

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi All,

Looking to create a saved search query with a subscription attached to highlight any account failures over the last 24 hours, so I can receive a report each morning.

If I search “CREATE ACCOUNT FAILED” it returns those that have failed, but struggling to work out how to apply a timeframe to this.

Can anyone assist please?

Please consider addressing the following when creating your topic:

  • What have you tried?
  • What errors did you face (share screenshots)?
  • Share the details of your efforts (code / search query, workflow json etc.)?
  • What is the result you are getting and what were you expecting?
2

Hi @DanMiddleditch , Have you tried something like this to get the activity for last 24hrs.

attributes.sourceName:* AND created:[now-1d/d TO now]

or

@accountRequests(provisioningTarget.name:“Active Directory”) AND created:>=2025-09-06

3

Thanks @bhaskar-kancherla I’ve used your recommendation and tweaked to get -

attributes.sourceName:“Active Directory” AND created:[now-1d/d TO now] AND status:FAILED AND operation:CREATE

This looks to give me what I’m after. Thanks :slight_smile:

1 Like
4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.