Okta: User Created [splunk-okta]

`get_application_data` eventType="user.lifecycle.create"
| eval dest_user='target{}.alternateId'
| table _time, host, user, action, dest_host, src_ip, src_user, signature, dest_user, City, Region, Country
| bin span=1s
| stats values(*) as * by _time, src_ip