Hi, I am working in a distributed Splunk environment with one search head and an indexer cluster. I am trying to monitor a path that is on the search head and I created a monitor input from the web GUI. How do I create an index on the indexer cluster and configure forwarding from the search head to the indexer cluster. Please help me. Thanks    ... View more

Hi , A newbie to Splunk here. I have found the query for  login info for users on a host:  index=os  source=var/log/secure  host=myhost process=sshd  I want to trigger an alert if a user  who has logged in before,  logs in to the host after more than 90 days. Could someone please help me how to write a query .  So the user should not have logged in for more than 90 days on the host.  Thank you   ... View more