I have to onboard(monitor) the so called “Linux secure” OS level log in the new index that I created called linux-secure and report all login attempts on OS level and Splunk level. Then also report all failed logins and the same way on OS level and Splunk. Finally the part that is really easy to create the dashboard. That I was told to do and to be honest I am baffled as simple as it looks ... View more

Thank you for your reply. I think linux_secure ... View more