An example log is helpful here, but you simply splunk the logs, create a field called user if it doesn't exist already, and then run the search. For example, if I want to see this result for the past 30 days:
sourcetype=mysecurelog earliest=-30d latest=now | top user limit=5
