Sorry for the question, I can't think of a sane & sensible way to get the data out of Splunk in a computationally efficient way:
Our data sources:
Active directory security events
CSVs of computer names & categories (e.g. computer*x*:public, computer*y*,private)
We want to look at the people usage of computers, but for only a subset of the computers - eg how many people used "public" computers for each hour over the last month.
Taking each computer name in turn and getting Splunk to search through the AD events looking for logons is very slow (the AD logs are 30GB+ a day). I've thought of creating a summary index with just some of the data but I can't quite figure out the best way of doing this.
Does anyone have any suggestions as to the "right" approach to take for getting these answers?