What about permissions?
may be user which is running splunk forwarder doesn’t have read access to those files under var.
with root on rhel:
setfacl -m u:splunkuser:r /var/log/secure
restart splunk you should see ssh logs from rhel8.
————————————
If this helps, give a like below.
