Is a field or value available in Duo that I can query via Splunk, that would enable me to sort by "Active" accounts? I am currently able to query the reason and factor fields for accounts that are not in Bypass, or that have authenticated via a particular authentication method, but I do not see a way to query accounts that are set to "Active." Any guidance on how to achieve this would be greatly appreciated! Ideally, I would like to be able to write something like:
index=duo factor="Active"
| stats dc(username) as active_students
