The app is working and I have data. I want a daily report at midnight for all eventtype=msad-user-changes for a period of the last 24 hours. This can either be saved or emailed to me.
There is an Action link, but does not seem to be doing anything. I am on version 1.2.1 App for Active Directory and Splunk version 5.0.2.
Thanks in advance