Hi , A newbie to Splunk here. I have found the query for  login info for users on a host:  index=os  source=var/log/secure  host=myhost process=sshd  I want to trigger an alert if a user  who has logged in before,  logs in to the host after more than 90 days. Could someone please help me how to write a query .  So the user should not have logged in for more than 90 days on the host.  Thank you   ... View more