If you want to search for linux users current login, you should identify the linux log where this data is being send to and index this file into Splunk.
Possible steps to take:
create an input to read this log file, assign this data to an index and sourcetype
Sample:
[monitor:///var/log/.log]
disabled = false
sourcetype = secure_log
index=linux
Depends on how the user information is showing on the file, there is a potential regex usage to extract the user from the log, if splunk is not capable to extract this info.
Please see a sample of code from this link. In this sample, the index is not specified, thus I recommend to always specify an index to assigned your indexed data and to not relying on default configuration if you are running on large splunk environment to avoid performance issues
https://gosplunk.com/list-of-users-in-a-linux-environment/
Splunk potential search based on the link attached above
index=linux sourcetype=secure_log | rex "\suser^'" | stats count by User
