Splunk search for Successful linux logins over time
Copy
sourcetype=linux_secure tag=authentication action=success | timechart count by src
This search will provide a timechart of successful logins to a linux system
sourcetype=linux_secure tag=authentication action=success | timechart count by src