It sounds like you want to monitor on CentOS7: `/var/log/secure` as that file has all the entries for SSH sessions. To make things less complicated: run the SUF as `root`, it will be easier to understand how things work. You can test on an isolated EC2 instance and secure later. If you want to forward `/var/log/secure` from other EC2 instances to your indexer, those will only require a SUF installed. You do not need a SUF and indexer installed on the same host. If you have installed Splunk proper, with web and all you can add a monitor input for `/var/log/secure`. ... View more

https://community.splunk.com/t5/Security/How-to-Reset-the-Admin-password/m-p/10622 ... View more